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FOREWORD 


This  report  was  prepared  by  Battelle  Memorial  Institute,  of  Columbus, 
Ohio,  under  USAF  Contract  No.  AF  33(616)- 3344,  initiated  under  WADC 
Project  No.  3307,  Tasks  Nos.  33064  and  33097,  administered  by  the  Propul¬ 
sion  Laboratory. 

This  report  includes  work  conducted  from  January,  1956,  to  January, 
1959,  with  emphasis  on  the  final  phase  of  study  from  June,  1957,  to 
January,  1959. 
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5  0  S  XING  AVENUE  COLUMBUS  l,  OHIO 

March  5,  1959 


Commander 

Wright  Air  Development  Center 
Wright-Patterson  Air  Force  Base 
Ohio 

Attention  WCLPBEL 

Contract  AF  33(6l6)-3344 


Dear  Sir: 

Enclosed  are  12  copies  plus  one  reproducible  copy  of  the  final  report, 
entitled  n Investigation  Toward  Providing  the  Best  Technical  Approach  to 
Attaining  and  Maintaining  Reliability  in  Propeller  Controls1*,  prepared  on 
Contract  AF33(6l6)-3344.  This  final  report  is  submitted  in  fulfillment  of 
the  requirements  for  the  research  program  conducted  by  Battelle  for  the 
Propulsion  Laboratory,  Wright  Air  Development  Center,  during  the  period 
January,  1956,  through  January,  1959. 

The  results  of  the  research  program  clearly  show  that  an  effective 
technical  approach  to  reliability  consists  of  not  just  one,  but  a  number  of, 
parallel,  complementary  actions  on  the  part  of  the  Laboratory  and  the  con¬ 
tractors.  An  organized  attack  on  the  reliability  problem  can  be  successful; 
it  involves  the  several  steps  of  definition,  testing,  and  evaluation  suggested 
in  this  report. 

Knowledge  and  understanding  of  the  many  facets  of  reliability  are  far 
from  adequate.  Progress  has  been  slow  because  what  has  been  learned  is 
often  applicable  only  to  discrete  cases  under  specific  conditions.  In  the 
course  of  this  research  program,  several  promising  areas  have  been  re¬ 
vealed  where  further  research  could  make  substantial  contributions  to  prog¬ 
ress  in  reliability. 

The  role  of  redundancy  in  the  success  of  past  and  present  aircraft  de¬ 
sign  is  evident.  However,  its  real  potential  and  ultimate  usefulness  is  only 
beginning  to  he  realized.  Questions  of  optimal  configuration  involving  quan¬ 
titative  application  of  engineering  cybernetics  and  systems  techniques  have 
hardly  been  explored  at  all. 


DEDICATED  TO  THE  ADVANCEMENT  OF  SCIENCE 


Commander 


2 


March  5,  1959 


Determination  of  accelerated  test  designs  and  evaluation  criteria  by- 
means  of  applied  statistical  probability  and  mo  del -theoretic  analysis  is  a 
most  promising  but  undeveloped  area.  As  reliability  requirements  increase 
as  a  consequence  of  the  increasing  cost  of  failure,  better  ways  must  be  de¬ 
veloped  to  predict  the  expected  frequency  of  events  that  occur  so  seldom  that 
they  may  never  be  observed  in  tests  or  in  service.  Appendixes  B  and  C  in 
this  report  are  first  steps  toward  this  goal. 

The  importance  of  environment  in  which  uncontrolled  forces  inhibit 
system  performance  is  undeniable.  Exact  knowledge  of  environment  coupled 
with  definitive  statements  of  material  properties  should  lead  to  theoretical 
laws  of  failure,  and  hence  to  the  necessary  generalization  of  such  laws  and 
useful  applications.  Until  this  can  be  accomplished,  and  as  one  method  con¬ 
tributing  to  its  accomplishment,  the  simulation  of  system  performance  by 
means  of  electronic  computational  aids  is  extremely  useful  in  estimating 
system  performance  and  reliability  in  an  operational  environment.  The 
simulation  presented  in  Appendix  E  is  an  example  of  the  development  of  an 
initial  simulation  model  for  estimating  the  influence  of  reliability  on  opera¬ 
tional  capability.  Thorough  exploration  of  the  variables  selected  for  even 
this  relatively  simple  model,  not  to  mention  the  equal  or  greater  number 
that  had  to  be  omitted,  was  not  possible  within  the  time  and  funds  available. 
A  skillfully  designed  simulation  is  most  valuable  as  a  research  tool  when  it 
is  used  repeatedly  to  sift  out  the  important  variables,  to  identify  significant 
parameter  boundary  values,  and  to  point  out  continuously  new  directions  for 
refinement  and  improvement  of  the  simulation.  Much  more  remains  to  be 
done  in  this  respect. 

We  enjoyed  this  opportunity  to  work  with  Propulsion  Laboratory  and 
other  Air  Force  personnel  with  interests  pertinent  to  reliability  in  propeller 
controls.  If  there  is  any  way  we  can  be  of  further  assistance,  we  will  be 
happy  to  do  so. 


Sincerely, 


E.  E.  Slowter 

EES:pa  Vice  President 

Enc.  (12  plus  I  reproducible) 

cc:  Commanding  Officer,  Transportation  Corps  Army  Aviation  Coordinat¬ 
ing  Office  WPAFB,  Attention  MCLATS-ED  (15  copies) 

Commanding  Officer,  Transportation  Research  and  Engineering  Com¬ 
mand,  Fort  Eustis,  Virginia  (3  reports) 

Chief,  Dayton  Air  Procurement  District  (letter  only) 

Mr.  Paul  E.  Weiser,  WCKCN,  WPAFB  (letter  only) 


ABSTRACT 


An  effective  reliability  program  must  contain  five  essential  activities: 
(1)  definition  of  reliability  terms  and  concepts,  (2)  specification  of  reliabil¬ 
ity  goals  and  criteria,  (3)  measurement  of  reliability  achievement,  (4)  com¬ 
parison  of  measured  reliability  with  specified  goals  and  criteria,  (5)  and 
engineering  action  to  attain  and  maintain  reliability.  This  study  describes 
specific  steps  in  a  technical  approach  to  propeller- control  reliability. 
Methodology  of  reliability,  field  experience,  and  a  computer  simulation 
developed  during  the  research  stiidy  are  described  in  detail.  Reliability  is 
defined  in  terms  of  operational  consequences  of  malfunction  and  failure. 
Numeric  goals  and  criteria  are  identified  in  the  context  of  design,  test,  and 
operation  of  propeller  controls.  Measurement  is  treated  in  terms  of  analy¬ 
ses  and  tests  to  be  performed.  A  characteristic  feature  of  the  reliability 
"growth11  process  is  the  continuing  need  for  comparisons  of  reliability  esti¬ 
mates  with  numeric  goals,  followed  by  engineering  action  to  attain  and  main¬ 
tain  reliability. 


PUBLICATION  REVIEW 


This  report  has  been  reviewed  and  is  approved 
FOR  THE  COMMANDER: 

CHARLES  M.  MICHAELS 

Chief,  Air  Breathing  Propulsion  Division 

Propulsion  Laboratory 
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INVESTIGATION  TOWARD  PROVIDING  THE  BEST 
TECHNICAL  APPROACH  TO  ATTAINING  AND 
MAINTAINING  RELIABILITY  IN  PROPELLER  CONTROLS 


INTRODUCTION 


Propeller  controls  for  turboprop  applications  are  designed  to  achieve 
automatic  control  of  propeller  operation  in  coordination  with  engine  fuel 
control  schedules.  Propeller  controls  are  vital  elements  in  the  propulsion 
system,  and  failure  of  these  controls  can  have  catastrophic  consequences, 
in  several  ways.  Failures  resulting  in  propeller  overspeed  can  lead  to 
destructive  vibration  and  disintegration  of  propeller  or  engine  components. 
Failures  resulting  in  loss  of  thrust  during  a  critical  maneuver  such  as  land¬ 
ing  or  take-off  or  resulting  in  negative  thrust  can  lead  to  loss  of  control  of 
the  aircraft  or  major  structural  damage. 

The  Propulsion  Laboratory,  Wright  Air  Development  Center,  is  re¬ 
sponsible  for  technical  and  operational  development  of  propeller  controls  in 
the  USAF.  The  Propulsion  Laboratory  recognized  that  operating  charac¬ 
teristics  of  turboprop  propulsion  systems  place  more  exacting  requirements 
on  the  propeller  and  its  control  than  its  conventional  predecessors.  High 
thrust  loading  and  wide  range  of  blade-angle  movement  are  required,  as 
well  as  increased  sensitivity  and  response  rates,  for  the  control  function. 

The  Propulsion  Laboratory  asked  Battelle  to  conduct  a  study  nTo  Determine 
the  Best  Technical  Approach  to  Reliability  of  Turboprop  Propeller  Control 
Systems11.  This  is  the  final  report  on  this  study. 

This  final  report  has  been  preceded  by  a  series  of  four  Battelle  reports 
on  particular  aspects  of  reliability  problems: 

(1)  ’’Formal  Definitions  of  Reliability”,  May  20,  1957,  dealing 

with  the  problem  of  defining  reliability  and  providing  a  . 

basis  for  relating  reliability  to  operational  experience 

(  et >  \**»-  O'?*' 

(2)  "Significance  of  Estimates  of  Reliability  Based  on  Truncated 
Sequential  Tests  of  a  Prototype  With  Repair  of  Failures”, 

June  20,  1957,  exploring  the  problem  of  endurance  testing 
of  prototype  propeller  controls  and  providing  a  method  for 
estimating  the  assurance  that  the  reliability  of  a  control  is 
greater  than  the  required  reliability  when  the  required 
reliability,  duration  of  tests,  and  a  number  of  failures  are 
known 


Manuscript  released  by  the  authors  6  March  1959  for  publication  as  a  WADC  Technical  Report. 
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(3)  "Reliability  Analysis11,  July  22,  1957,  discussing  meth¬ 
ods  of  estimating  and  predicting  reliability  in  various 
states  during  development 

(4)  "Obtaining  Reliability  in  Propeller  Controls  for  Turbo¬ 
prop  Applications" ,  January  31,  1958,  describing  the 
basis  for  a  continuing  reliability  program  for  propeller 
controls  in  the  context  of  weapon- system  development 
and  USAF  procedures  for  managing  weapon- system- 
development  programs. 

The  final  report  emphasizes  the  main  points  of  the  preceding  studies 
and  describes  specific  steps  in  a  technical  approach  to  propeller -control 
reliability.  The  principles  and  procedures  for  attaining  reliability  are  in 
the  main  applicable  both  to  propeller  controls  and  to  other  functional  com¬ 
ponents  of  weapons  systems.  Detailed  results  of  the  final  phase  of  the  study 
are  presented  in  the  Appendixes.  The  main  objectives  in  this  final  phase 
are  to  gain  understanding  of  the  impact  of  reliability  testing,  operational 
environment,  and  criteria  of  success  on  equipment  reliability  in  service  and 
to  examine  possible  approaches  to  these  problems.  The  basic  concepts  of 
reliability  are  reviewed  briefly  in  Appendix  A.  The  problem  of  reliability 
testing  and  verification  is  explored  in  Appendix  B,  Appendix  C  presents  a 
novel  approach  to  accelerated  testing  as  a  problem  of  modeling.  An  analysis 
of  field  experience  with  turboprop  systems  is  presented  in  Appendix  D. 
Appendix  E  describes  a  digital -computer  simulation  of  turboprop  aircraft 
system  operations  under  alter  native  conditions  of  operational  demand  and 
reliability. 


PLANNED  GROWTH  OF  A  WEAPON  SYSTEM 


At  the  time  an  operational  requirement  for  a  weapon  system  is  gen¬ 
erated,  there  is  a  general  notion  of  the  reliability  required  if  the  system  is 
to  be  operationally  successful.  Reliability  finds  quantitative  expression  at 
this  early  stage  in  the  form  of  estimates  of  the  force  size  required  to  per¬ 
form  the  prescribed  mission,  allowing  for  availability,  abort  rates,  non¬ 
combat  losses ,  maintenance,  and  logistic  support.  These  are  gross  esti¬ 
mates  ,  based  on  experience  with  other  systems  of  similar  type  operating  in 
a  wide  variety  of  situations.  These  early  estimates  cannot  be  stated  in 
terms  of  specific  reliability  levels.  Specific  reliability  levels  will  be  de¬ 
pendent  upon  particular  design  features  of  the  system  yet  to  be  developed. 
Therefore,  these  estimates  represent  goals  that  subsequent  development 
actions  must  achieve. 

More  specifically,  the  USAF  operational  goals  in  which  reliability 
plays  an  important  part  include  the  following: 
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(1)  To  maximize  the  probability  o£  success  for  the  next  mission 

(2)  To  maximize  availability  for  the  next  mission 

(3)  To  minimize  total  risk  during  the  operational  life  of  the 
system 

(4)  To  minimize  total  costs  during  the  operational  life  of  the 
system. 

When  an  operational  requirement  has  been  established,  the  next  step 
is  to  estimate  the  feasibility  of  designing,  developing,  and  producing  the 
weapon  system  to  perform  the  intended  function.  This  is  usually  accom¬ 
plished  by  obtaining  preliminary  designs,  first  estimates  of  engineering 
feasibility  and  costs,  and  an  evaluation  of  the  problems  standing  in  the  way 
of  successful  development.  In  modern  complex  systems,  reliability  is  one 
of  the  problems  that  may  cast  doubt  on  the  potential  success  of  a  develop¬ 
ment  program.  Heretofore,  reliability  has  seldom  been  evaluated  until 
other  performance  requirements  were  attained.  Experience  shows  that 
reliability  must  be  considered  from  the  beginning  of  development  in  order 
to  assure  that  equipment  with  acceptable  inherent  reliability  may  be 
produced. 

If  it  is  decided  to  develop  the  weapon  system,  plans  and  programs 
must  be  established  to  guide  and  evaluate  the  development  effort  toward  the 
desired  goals.  Advance  preparation  for  planning  the  "growth**  of  a  weapon 
system  can  be  as  difficult  and  problematical  in  many  ways  as  the  develop¬ 
ment  work  that  is  to  follow.  This  is  presently  true  in  planning  reliability 
"growth".  The  statement  of  requirements  for  subsystems  and  components 
should  state  the  reliability  goals  as  well  as  the  performance  goals  to  be 
achieved.  Procedures  for  evaluating  and  testing  the  development  items 
must  be  determined,  and  the  basis  for  acceptance  of  the  final  products  estab¬ 
lished.  Before  development  can  proceed,  there  is  at  present  a  need  for 
more  information  regarding  the  technical  aspects  of  design  and  the  opera¬ 
tional  environment  relevant  to  reliability. 

A  plan  for  achieving  reliable  propeller  controls,  the  subject  of  this 
study,  should  be  a  part  of  the  plan  for  developing  the  propulsion  system, 
and,  hence,  the  complete  aircraft  system. 


PLANNED  GROWTH  OF  RELIABILITY 


"The  objective  of  a  reliability  program  is  to  achieve  the  highest 
degree  of  reliability  consistent  with  design  objectives,  economic 
constraints,  and  the  operational  mission  concerned.  A  prac¬ 
tical  program  for  reliability  must  recognize  the  facts  of  life 
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about  the  environment  in  which  it  will  operate.  It  should  be 
consistent  with  existing  USAF  development  policies  and 
procedures.  It  must  possess  a  logical  sequence  of  develop¬ 
ment  steps  for  'growing1 2  reliability.  It  must  fit  into  present 
development  programs  as  a  part  of  the  program  require¬ 
ments,  Finally ,  it  must  provide  a  feedback  of  useful  infor¬ 
mation  for  improving  future  reliability  programs.  " 

The  above  is  quoted  from  a  previous  report(^)  on  this  contract.  It 
states  some  fundamental  truths  for  reliability  programming  and  identifies 
the  achievement  of  reliability  as  a  "growth"  process.  The  reliability  goal 
from  the  USAF  viewpoint  is  the  reliability  ultimately  attained  in  operations. 
Not  only  does  this  involve  the  functional  integrity  and  inherent  reliability  of 
the  system,  but  it  must  account  for  the  effects  of  assigned  task,  operational 
policy,  doctrine,  maintenance,  and  the  entire  operational  environment. 
Further,  performance  of  the  system,  although  essential,  can  pertain  to  one¬ 
time  accomplishment,  whereas  reliability  always  implies  repeated  accom¬ 
plishment  over  a  period  of  time.  To  "grow"  reliability  for  complex  equip¬ 
ment,  one  must  start  from  meager  beginnings  and  design,  test,  and 
redesign  until  the  probability  of  failure  is  low  enough  to  provide  for  the 
required  reliability  in  operations,  in  spite  of  the  inevitable  operational 
degradation. 

There  appears  to  be  no  single  action  that  in  itself  can  achieve  reliabil¬ 
ity.  Instead,  the  technical  approach  to  reliability  with  the  best  chance  of 
sucess  consists  of  a  number  of  actions  pursued  throughout  propeller- control 
design,  development,  production,  and  operation: 

(1)  Centralize  responsibility  for  the  reliability  program. 

(2)  Establish  reliability  requirements  and  plan  approaches 
to  reliability  "growth"  in  advance. 

(3)  Perform,  review,  and  evaluate  reliability  analyses. 

(4)  Conduct  and  evaluate  reliability  tests, 

(5)  Collect  and  disseminate  reliability  information. 

(6)  Monitor  reliability  "growth"  throughout  the  life  of  the 
system. 

For  the  weapon  systems  over  which  it  has  cognizance,  WADC  "is  es¬ 
sentially  the  prime  contractor  for  the  actual  research  and  development  ef¬ 
fort  for  a  given  program"(2).  The  logical  location  for  centralized 


(1)  Debeau,  0.  E. ,  Farrar,  D,  L. ,  et  aL ,  "Attaining  Reliability  in  Propeller  Control!  for  Turboprop  Applica¬ 
tion*",  Special  Report,  USAF  Contract  No.  A F  33(6 16)- 3344,  Battelle  Memorial  Institute,  January  15, 
1958. 

(2)  ARDC  Manual  80-4,  dated  1  September  1956. 
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responsibility  for  propeller- control  reliability  is  the  Propulsion  Laboratory. 
The  Laboratory  should  provide  definitive  guidance  for  the  development  and 
operational  use  of  propeller  controls  and  similar  control  components  in  the 
form  of  reliability  definitions,  requirements,  goals,  environmental- design 
information,  test  and  evaluation  procedures  and  criteria,  reliability- 
analysis  procedures,  component  and  system  performance  histories,  and 
recommended  inspection,  maintenance,  overhaul,  and  pro  duct- improvement 
methods.  Each  of  these  actions  contributes  to  reliability  growth  during  the 
evolution  and  life  of  the  control.  Each  action  requires  continuous  effort  on 
current  developments  and  in  preparation  for  future  developments. 

The  Laboratory  must  be  prepared  to  state  reliability  requirements 
and  actions  to  be  taken  to  demonstrate  that  these  requirements  have  been 
satisfied  at  the  following  points  in  the  life  cycle  of  a  propeller  control: 

(1)  Preliminary  Design:  The  design  study  should  indicate 
gross  reliability  requirements  and  the  technical  basis 
for  evaluating  reliability  in  subsequent  laboratory  and 
flight  tests. 

(2)  Statement  of  Work:  The  statement  of  work  should  indi¬ 
cate  preliminary  estimates  of  propeller- control  reliabil¬ 
ity  requirements  and  preliminary  test  plans  for  labora¬ 
tory  evaluation  of  reliability  that  have  been  shown  to  be 
feasible, 

(3)  Reliability  Analyses:  Reliability  analysis  of  initial  de¬ 
signs  should  be  based  on  the  best  available  reliability 
data  from  WADC  sources  and  industry  experience. 

(4)  Component  Evaluations:  Component  evaluations  should 
be  based  on  selected  test  conditions  derived  from 
previous  findings  of  reliability  analyses,  analyses  of  the 
operational  environment,  and  extensions  of  model- 
theoretic  formulations  for  accelerated  tests. 

(5)  Laboratory  Tests:  Qualification  tests ,  type  tests,  and 
experimental  flight  clearance  tests  should  be  supple¬ 
mented  by  selected  accelerated  tests  for  evaluation  of 
reliability  with  respect  to  emergency  and  catastrophic 
consequences.  These  tests  should  be  complemented  by 
reliability  analyses  reflecting  current  design 
configuration. 

(6)  Production:  Inherent  reliability  demonstrated  by  the 
manufacturer  and  WADC  shotild  be  preserved  in 

the  production  process  by  means  of  sequential- 
sampling  quality- control  methods  that  include  short- 
and  long- duration  running  of  a  sample  of  the  production 
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controls.  Consideration  should  be  given  to  the  develop¬ 
ment  of  an  accelerated  test  to  replace  the  very  long 
endurance  tests  now  given  to  a  very  small  sample  of 
production  controls. 

(7)  Flight  Tests:  Flight  tests  (Categories  I  and  11^))  should 
be  monitored  to  provide  specific  failure  data  as  to  cause , 
effect,  frequency,  and  operating  history  to  be  used  in 
revising  reliability  analyses  and  the  selected  conditions 
for  laboratory  and  manufacturer  production  tests. 

W  Operations:  Changes  in  operational  reliability  should  be 
monitored  to  provide  engineering  data  as  well  as  reliabil¬ 
ity  data  for  design  changes  and  revision  of  reliability 
estimates. 

In  the  following  paragraphs,  certain  specific  recommendations  are 
made  for  Laboratory  action  toward  attaining  and  maintaining  propeller- 
control  reliability  in  present  and  future  weapon  systems. 


STATE  GROSS  OPERATIONAL  RELIABILITY  REQUIREMENTS 
FOR  THE  SYSTEM  AND  REFINE  THESE  VALUES  AS  DEVEL¬ 
OPMENT  PROCEEDS  THROUGH  DESIGN,  PRODUCTION,  AND 
OPERATIONAL  USE. 


Analyses  similar  to  those  in  Appendix  E  may  be  available  initially  from 
systems  requirements  studies  preceding  the  development  program.  The 
gross  values  for  operational  reliability  are  derived  at  first  from  estimated 
flying  loads  (flying  hours  per  unit  time),  organizational  strengths,  and  other 
operating  conditions  in  comparison  with  specific  mission  requirements  that 
determine  the  allowable  minimum  availability  rates  and  maximum  abort 
rates,  repair  rates,  and  logistics.  Propeller  controls  are  but  one  compo¬ 
nent  of  the  aircraft  system  contributing  to  the  operation.  As  a  vital  compo¬ 
nent,  experience  shows  that  such  controls  should  contribute  less  than  10  per 
cent  of  the  total  abort,  repair,  or  logistic  burden,  the  exact  value  being  a 
matter  of  judgment.  Initially,  gross  reliability  values  for  categories  of 
failure  are  estimated  on  the  basis  of  an  average  of  past  operational  experi¬ 
ence  for  aircraft  available,  mission  completion,  and  malfunctions  per  unit 
time.  As  experience  is  gained  with  the  controls,  more  accurate  and  com¬ 
plete  evaluations  should  be  possible* 


(1)  APR  80-14,  19  August  1958. 
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DEFINE  RELIABILITY  AND  DESIRABLE  MINIMUM  VALUES 
FOR  SPECIFIC  RELIABILITY  CATEGORIES  (Appendix  A): 
CATASTROPHIC  RELIABILITY,  EMERGENCY  RELIABIL¬ 
ITY,  FIELD-MAINTENANCE  RELIABILITY,  OPERATING 
LIFE, 


Definitions  of  reliability  and  categories  of  reliability  based  on  “mean 
life"  concepts  are  described  in  Appendix  A.  Numeric  goals  for  each  cate¬ 
gory  of  reliability  may  be  stated,  but  estimates  of  the  reliability  of  the 
control  cannot  be  made  until  discrete  design  configurations  have  been  iden¬ 
tified.  When  each  configuration  has  been  defined,  estimates  of  reliability 
should  be  compared  with  goals  such  as  the  following: 

(1)  Probability  of  propeller- control  malfunctions  with 
catastrophic  conse  fences  should  be  less  than  1  x  10“ ^ 
per  flying  hour. 

(2)  Probability  of  propeller- control  malfunctions  with 
emergency  consequences  should  be  less  than  that  value 
for  which  combined  emergency  malfunctions  can  produce 
catastrophic  consequences  more  frequently  than  1  in 

10*  flying  hours  (e,  g.  ,  for  a  four-engine,  turboprop  air¬ 
craft  with  independent  controls,  probability  of  emergency 
malfunctions  should  be  less  than  3  x  10“  ^  per  flying  hour). 

(3)  Probability  of  propeller- control  malfunctions  resulting  in 
field -maintenance  requirements  should  be  l&’ss  than 

0.  01  per  flying  hour. 

(4)  Probability  of  propeller- control  malfunction  resulting  in 
removal  for  overhaul  should  be  less  than  0,  001  per  flying 
hour.  For  this  value,  the  fraction  of  the  initial  number 
of  controls  surviving  to  1500  hours  would  be  0.22. 

In  the  design  stage,  the  confidence  levels  for  the  reliability  estimates 
are  likely  to  be  quite  low,  i.  e.  ,  below  0.  50.  This  does  not  mean  that  relia¬ 
bility  is  low,  but  that  knowledge  required  to  narrow  the  confidence  interval 
is  lacking.  As  experience  is  gained  through  physical  tests(^)  and  reliability 
analysis'^),  engineering  estimates  of  likely  causes  of  failure  and  probability 


(1)  Kuhn,  G.  R.,  Debeau,  D.  £.»  and  Swager,  W.  L,  "Significance  of  Estimates  of  Reliability  Based  on 
Tiuncated  Sequential  Test  of  a  Prototype  With  Repair  of  Failures",  Special  Report,  USAF  Contract 
No.  33(6 16)- 3344,  BatteUe  Memorial  Institute,  June  20,  1957. 

(2)  Debeau,  D,  E. ,  Farrar,  D.  L  •  et  al. ,  op.  cit. 
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of  occurrence  of  malfunction  will  improve.  With  this  additional  information, 
estimates  of  reliability  with  higher  confidence  levels  should  be  possible. 
Before  production  is  initiated,  every  effort  must  be  made  to  estimate  the 
reliability  values  at  least  at  the  0.  90  confidence  level. 


CONTINUE  DEVELOPMENT  OF  FUNDAMENTAL  APPROACHES 
TO  RELIABILITY,  QUANTITATIVE  CRITERIA,  AND  METHODS. 


Development  of  a  model- theoretic  approach  to  reliability  in  Appen¬ 
dix  C  represents  an  enlightening  departure  from  "mean  life"  concepts  of 
failure,  particularly  for  catastrophic  reliability  requirements.  The  primary 
concern  in  predicting  catastrophic  failures  is  with  the  "tail"  of  the  probabil¬ 
ity  density  function,  where  early  failures  occur.  This  novel  approach  con¬ 
cludes  that  "mean-life"  requirements  are  not  appropriately  applied  to 
catastrophic  reliability  of  highly  reliable  systems.  For  example,  it  is  pro¬ 
posed  that  the  catastrophic  requirement  take  the  following  form:  "Demon¬ 
strate  with  90  per  cent  confidence  that  the  probability  of  catastrophic  failure 
of  the  system  with  10^  operating  hours  under  normal  use  is  less  than  0.  001.  " 


PLAN  TO  PROVIDE  TECHNICAL  AND  OPERATIONAL  DATA 
FOR  DESIGN,  DEVELOPMENT,  AND  PRODUCTION  PHASES 
OF  THE  PROGRAM. 


The  Laboratory  should  supplement  the  information  presently  made 
available  to  design,  development,  and  production  functions  with  as  many 
data  as  possible  pertaining  to  reliability  experience  on  systems,  components, 
and  parts  related  to  the  field  of  interest.  There  is  at  present  no  adequate 
source  of  reliability- engineering  data  for  mechanical,  hydraulic,  or  pneu¬ 
matic  equipment  as  there  is  for  electrical  and  electronic  equipment.  Mili¬ 
tary  specifications  in  their  present  form  are  generally  inadequate  for  relia¬ 
bility  estimation  when  the  application  in  question  involves  marginal 
performance  or  alternative  environmental  conditions.  Because  reliability 
estimates  in  the  design  and  development  phases  depend  upon  engineering 
judgment  to  a  great  extent,  there  is  real  need  for  comparative  information 
for  this  purpose. 
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OBTAIN  VALID  FUNCTIONAL  DESCRIPTIONS  AND  RELIA¬ 


BILITY  ANALYSES  OF  EACH  CONTROL  CONFIGURATION 
SUCH  THAT  SEQUENTIAL,  INDEPENDENT,  AND  REDUN¬ 
DANT  FEATURES  OF  DESIGN  ARE  CLEAR,  AND  PRINCI¬ 
PLES  OF  STATISTICAL  PROBABILITY  ARE  PROPERLY 
APPLIED  IN  ESTIMATING  THE  PROBABILITY  AND  CON- 
SQUENCES  OF  FAILURE. 


Reliability  analyses  based  on  valid  functional  descriptions  of  the  pro¬ 
peller  control(2)  are  the  main  feature  in  any  reliability  effort.  Vague  com¬ 
parisons  of  complexity  attempted  in  the  past  are  not  adequate.  The  analysis 
must  consider  the  effects  of  failure,  relation  of  parts  and  components  to 
each  other  in  a  dynamic  sense,  and  specific  stress  conditions  involved.  De¬ 
tailed  rules  cannot  and  should  not  be  stated  at  this  time.  Each  problem  is 
singular  in  some  way,  and  engineering  judgement  and  skill  are  required  to 
perform  the  analysis  for  each  configuration  and  each  phase  of  development. 
Reliability  analyses  of  production  and  operational  equipment  should  have  the 
benefit  of  data  from  tests  and  field  experience  to  establish  cause-and- effect 
relationships  and  firm  estimates  of  reliability  measures  for  observed  failure 
events.  Thus,  reliability  can  become  as  demonstrable  as  other  performance 
qualities.  However,  prompt  feedback  of  test  and  field  data  is  necessary  in 
view  of  present  accelerated  procurement  delivery  schedules. 


SUPPORT  COMPONENT-EVALUATION  TESTS 
BY  MANUFACTURERS. 


Evaluation  of  the  components  independent  of  the  system  is  properly  a 
consideration  of  the  manufacturers.  The  Laboratory  should  support  the 
manufacturers  with  collateral  information  on  component  test  design  and  ex¬ 
perience  from  previous  developments  and  information  relating  the  results  of 
previous  component  tests  to  usage  experience  with  these  components. 


(1)  Baum,  J.  V.,  Kuhn,  G. ,  Debeau,  D,  E.,  and  Farrar,  D.  U,  "Reliability  Analysis:  A  Part  of  an  Investiga¬ 
tion  Toward  Providing  the  Best  Technical  Approach  to  the  Reliability  of  Propeller  Controls  for  Turboprop 
Applications",  Special  Report,  USAF  Contract  No.  AF  33(6l6)-3344,  Battelle  Memorial  Institute,  July  22, 
1957. 

(2)  Baum,  J.  V.,  Kuhn,  G.,  Debeau,  D.  F.,  and  Farrar,  D.  L.,  op,  cit. 
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PLAN  LABORATORY  RELIABILITY  TEST  PROGRAMS  IN 


ADVANCE  TO  SPECIFY  THE  METHODS  OF  EVALUATING 
THE  RELIABILITY  ASPECTS  OF  PROPELLER  CONTROLS. 


Prior  to  the  design  and  development  of  a  propeller  control,  the  Labora¬ 
tory  should  specify  the  testing  program  that  will  be  used  to  evaluate  the 
reliability  aspects  of  the  control.  This  information  is  essential  guidance 
both  to  the  designers  and  to  the  Labor atory*s  own  project  officers. 

The  tests  conducted  under  the  cognizance  of  the  Laboratory  include 
Qualification  Tests,  Type  Tests,  and  Flight  Clearance  Tests,  Although 
these  tests  are  intended  mainly  to  produce  functional  evaluations,  some  of 
them  may  also  provide  useful  information  for  reliability  evaluation  if  provi¬ 
sion  is  made  for  collection  and  evaluation  of  such  information  in  advance. 

The  tests  run  today  are  primarily  nonaccelerated  tests  under  idealized 
environmental  conditions.  Since  the  real  operational  environment  cannot  be 
simulated  exactly,  these  tests  provide  an  estimate  of  inherent  reliability 
within  the  design  conditions  specified,  rather  than  an  estimate  of  operational 
reliability.  The  Laboratory  should  study  operational  environment  on  a  con¬ 
tinuous  basis  in  order  to  provide  an  improved  basis  for  test  design.  This 
continuous  study  involves  evaluation  of  observed  ope  rationed  failures  for 
interpretation  as  to  causes  and  consequences  and  statistical  patterns. 

For  each  test,  the  Laboratory  must  decide  the  purpose  and  the  informa¬ 
tion  desired  with  respect  to  reliability.  For  instance,  it  may  be  decided  that 
an  experimental  flight  clearance  test  should  provide  a  50  per  cent  assurance 
that,  under  laboratory  running  conditions,  the  mean  time  to  a  malfunction 
with  potentially  emergency  consequences  should  be  greater  than  300  hours. 
The  Laboratory  should  then  use  a  statement  of  requirement  such  as  the  one 
above  to  specify  the  number  of  hours  of  testing  to  be  accomplished  with  no 
malfunction  with  potentially  emergency  consequences.  Using  the  hypothetical 
example  above  and  Figure  B-2  in  Appendix  B,  it  may  be  estimated  that  at 
least  240  hours  of  running  by  the  Laboratory  would  be  required. 

Propeller  controls  are  vital  elements  in  the  aircraft  system.  The 
reliability  requirement  for  such  vital  elements  is,  by  definition,  very  high 
(i.  e.  ,  probability  of  catastrophic  consequences  of  malfunction  less  than 
1  x  10-7  per  flying  hour  and  probability  of  emergency  consequences  of  mal¬ 
function  less  than  3  x  10"^  per  flying  hour).  Nonaccelerated  laboratory 
tests  cannot  economically  provide  any  reasonable  assurance  that  these  high 
reliability  levels  have  been  achieved. 

Accelerated  laboratory  tests  specifying  selected  sets  of  environmental 
conditions,  abuse  ratios,  hours  of  testing,  and  sample  size  appear  to  be 
feasible  in  the  model- theoretic  sense  illustrated  in  Appendix  C.  The 
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Laboratory  should  continue  development  of  this  approach  as  the  only  pres¬ 
ently  identified  means  of  evaluating  the  reliability  of  highly  reliable  systems. 


USE  RELIABILITY  EVALUATIONS,  ANALYSES,  AND  TESTS 
TO  DETERMINE  THE  NEED  FOR  ENGINEERING  ACTIONS 
TO  IMPROVE  RELIABILITY. 


The  statistical  evaluations  that  provide  estimates  of  reliability  do  not 
necessarily  indicate  the  actions  to  be  taken  in  improving  the  design.  The 
actions  required  are  engineering  actions,  based  on  knowledge  of  the  physical 
properties  and  stresses  involved.  The  assurance  with  which  reliability  can 
be  estimated  is  directly  dependent  upon  the  precision  with  which  the  stress/ 
strength  relationships  in  the  system  environment  are  known,  as  well  as  on 
the  duration  of  testing.  In  early  development  phases,  lack  of  precise  knowl¬ 
edge  about  stress /strength  relationships  in  the  operational  environment  is 
responsible  for  the  low  assurance  in  reliability  estimates. 

Engineering  actions  that  may  be  taken  to  improve  reliability  are  of 
several  types.  Choice  of  action  is  a  matter  of  engineering  skill  and  judg¬ 
ment,  with  appropriate  reliability  estimates  providing  additional  guidance. 

Reliability  can  be  improved  by  selection  of  materials  that  provide 
more  favorable  strength/stress  relationships  in  specific  cases.  The  di¬ 
mensions  and  other  critical  characteristics  of  parts  and  components  made 
from  these  materials  can  be  altered  to  increase  failure  thresholds  and  time 
between  failures.  There  is  often  a  choice  among  alternative  mechanisms 
for  accomplishing  the  functions  of  force  transmission  or  control.  One 
criterion  would  be  estimated  reliability  of  the  system  for  each  alternative. 
Design  configurations  based  on  functional  requirements  are  likewise  a  matter 
of  choice,  and  reliability  is  one  criterion.  The  use  of  redundancy  to  parallel 
or  provide  "fail-safe"  operation  of  major  assemblies  as  opposed  to  compo¬ 
nent  redundancy  is  often  an  effective  engineering  design  method.  The  actions 
taken  to  improve  reliability,  then,  are  engineering  actions.  The  need  for 
action  is  determined  by  the  reliability  evaluations,  analyses,  and  tests. 


ESTABLISH  CLOSE  LIAISON  WITH  OPERATIONAL  COMMANDS 
PHASING  IN  NEW  PROPELLER-CONTROL  MODELS  IN  ORDER 
TO  OBTAIN  OPERATING  RECORDS  SUPPLEMENTING. 
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RELIABILITY  DATA  FROM  PRODUCT- IMPROVEMENT 


PROGRAMS  OR  OTHE  R  SOURCES. 


Results  of  the  field- data- collection  program,  presented  in  Appen¬ 
dix  D,  indicate  the  value  of  first-hand  information  on  operating  history. 

Such  information  can  be  obtained  without  interfering  with  operational  re¬ 
quirements  of  the  Commands.  For  operational  reliability  estimates,  it  is 
essential  to  know  the  effects  of  malfunctions,  ope  rating- time  history  of  each 
control,  and  maintenance /logistic  support  environment  for  a  period  not  less 
than  the  50  per  cent  survived  time  estimated  for  the  control.  In  this  study, 
the  DD  Form  781-2  proved  a  useful  source  of  information.  This  form  has 
been  superseded  by  AFTO  781- A. 


USE  COST  COMPARISONS  CAUTIOUSLY  IN  EVALUATING 
RELIABILITY  FOR  DEVELOPMENT  PROGRAMS. 


The  costs  of  design  and  development  that  can  appropriately  be  charged 
to  reliability  as  opposed  to  other  design  requirements  cannot  be  established 
with  any  reasonable  accuracy  at  this  time.  Costs  incurred  in  service  as  a 
result  of  reliability  limitations  or  other  operating  problems  are  subject  to 
wide  latitude  in  interpretation.  Both  of  these  cost  areas  are  basic  inputs  to 
a  cost  analysis  of  the  relationship  between  development  effort  and  utilization 
costs.  Until  there  is  substantial  improvement  in  the  available  quantitative 
estimates  of  such  costs,  it  does  not  seem  advisable  to  base  cost  limitations 
for  reliability  development  upon  a  comparison  of  this  nature. 


CONCLUSIONS 


Planned  growth  of  reliability  through  effective  application  of  the  relia¬ 
bility  concepts  and  procedures  described  herein: 

(1)  Will  create  a  better  understanding  of  reliability  problems 
in  the  design  and  development  of  propeller  controls  and 
other  components  of  weapon  systems 

(2)  Will  afford  the  means  for  prompt,  positive  action  toward 
attaining  and  maintaining  reliability  in  weapon  systems 
and  their  components. 
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CONCEPTS  OF  RELIABILITY 


Fundamental  Notions 


The  fundamental  notion  of  reliability  or  dependability  has  existed 
throughout  history.  Reliability  has  signified  qualitative  judgment  expressed 
as  some  degree  of  confidence  that  a  device  or  even  a  person  would  in  the 
future  perform  some  intended  function.  There  was  no  quantitative  measure 
associated  with  this  judgment,  only  a  subjective  statement  of  confidence. 
Reliability  was  considered  a  desirable  quality  and,  in  many  cases,  particu¬ 
larly  military  applications,  an  essential  one.  Until  recently,  no  serious 
attempt  was  made  to  state  reliability  in  quantitative  terms  because  it  was 
known  to  be  dependent  upon  the  explicit  conditions  surrounding  a  particu¬ 
lar  situation  and,  thus,  was  highly  variable.  Present  determination  to 
measure  reliability  and  to  use  it  as  a  criterion  for  performance  stems 
from  the  need  to  evaluate  future  situations  in  terms  of  two  univer sally 
important  factors,  risk  and  cost.  Risk  involves  the  probability  of  failure 
and  the  attendant  losses  expected  as  a  result  of  that  failure  and,  hence, 
introduces  the  notions  of  statistical  probability  and  expectancy.  Cost  is 
the  economic  measure  of  relative  gain  or  loss  on  some  arbitrary  value 
scale. 


Failure  Rate 


In  the  intuitive  sense,  reliability  is  associated  with,  if  not  in  fact 
measured  by,  frequency  of  failure  its  inverse  function,  the  interval 
between  failures.  It  has  been  shown  that  complex  equipment  consisting  of 
a  relatively  large  number  of  parts  exhibits  certain  characteristic  patterns 
of  failure  over  time.  The  actual  quantitative  values  involved  may  vary, 
depending  upon  environment,  but  the  form  of  the  pattern  remains  es¬ 
sentially  the  same.  Different  equipments  will  show  one  or  more  of  the 
different  types  of  failure  involved. 

The  patterns  of  failure  observed  for  complex  equipment  are  shown 
in  Figures  1  and  2.  The  difference  between  them  is  simply  that 
Figure  1  relates  failures  per  unit  time  to  the  number  of  surviving 
equipments  operating  in  that  unit  of  time,  whereas  Figure  2  relates 
failures  per  unit  time  to  the  original  or  initial  number  of  units,  failures 
thus  decreasing  as  the  number  of  surviving  units  decrease.  Otherwise, 
both  express  identical  rates  of  failure  and  can  be  discussed  simultaneously. 
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Hazard  Rate 


Time 

FIGURE  1.  TYPICAL  FAILURE -RATE  (HAZARD-RATE)  CURVE 
BASED  ON  NUMBER  OF  SURVIVING  UNITS 


FIGURE  2.  TYPICAL  FAILURE-RATE  CURVE  BASED  ON 
INITIAL  NUMBER  OF  UNITS 
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The  initial  failure  rate  or  "infant  mortality11  failures  result  from 
manufacturing  defects,  damage  in  shipping  or  handling,  or  errors  in 
installation.  To  some  degree,  all  equipment  will  always  be  subject  to  such 
failures.  The  incidence  of  manufacturing  defects  and  marginal  parts  can 
be  reduced  by  improved  manufacturing  or  quality- control  procedures  or 
"green-running".  Very  often  these  parts  are  not  recognizable  as  defective 
until  they  fail. 

The  random-failure  or  "normal"  operating  period  is  that  period 
during  which  failure  rate  is  essentially  constant  and  failures  can  occur 
with  equal  probability  at  any  time.  Foreign-object  damage  is  one  example 
of  the  uncontrollable  failures  that  can  occur  during  this  period.  The  dura¬ 
tion  of  the  random-failure  period  depends  upon  the  aging  process  or  the 
occurrence  of  wear -out  and  the  operational  environment,  represented  by 
duty  cycles,  severity  of  use,  maintenance,  etc. 

The  last  period  is  the  "wear -out"  period,  during  which  the  failure 
rate  rapidly  increases  as  more  of  the  equipments  reach  their  critical  age 
and  begin  to  deteriorate.  This  period  of  failure  can  be  avoided  entirely 
by  replacement  of  parts  before  they  reach  critical  age. 


Categories  of  Failure 

The  difficulty  in  quantifying  reliability  stems  in  part  from  the  more 
basic  problem  of  defining  failure  in  quantitative  terms.  In  the  intuitive 
sense,  a  failure  is  an  unsuccessful  attempt  to  perform  some  action.  Again, 
failure  is  a  subjective  judgment  in  that  the  degree  of  unsuccessfulness  is  not 
specified.  Since  reliability  is  contingent  upon  the  nonoccurrence  of  failure, 
the  definition  of  failure  is  fundamental  in  the  concept  of  reliability. 

Failure  may  be  defined  subjectively  as  the  inability  of  equipment  to 
perform  its  required  function  (Reference  37),  or  operation  outside  of  design 
tolerances,  or  failure  to  meet  specified  operational  requirements.  These 
and  other  current  definitions  of  failure  are  posed  in  terms  of  the  conse¬ 
quences  of  failure,  rather  than  the  essence  of  failure  itself.  Comparatively 
little  is  known  about  why  materials  fail,  why  environmental  influences  such 
as  temperature,  humidity,  vibration,  moisture,  or  radiation  cause 
deterioration  of  material  strength.  The  cause -and-effect  relations  now 
employed  to  express  failure  characteristics  avoid  the  unknown  essence  of 
failure.  This,  in  part,  is  responsible  for  the  present  use  of  statistical 
probability  relations,  where,  if  they  were  known,  physical  laws  of  failure 
would  be  more  accurate  and  revealing. 

Since  the  weight  of  evidence  is  presently  in  the  consequences  of 
failure,  the  categories  of  failure  selected  should  reflect  this  state  of 
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affairs.  Some  categorical  schemes  suggested  by  manufacturers  and  users 
of  propeller  controls  are  shown  in  Table  1.  Failure  is  defined  in  terms 
of  its  consequences,  rather  than  its  causes,  and  is  meaningful  from  an 
operational  point  of  view  in  terms  of  the  fraction  of  failures  that  cause 
mission  failure. 

Another  scheme  classifying  failure  in  accordance  with  its  relation 
to  intended  function  gives  a  clearer  picture  of  the  nature  of  failure  causes 
and  effects  on  mission  success.  In  Table  2,  two  classes  of  stress  are 
distinguished,  extrinsic  stresses  and  intrinsic  stresses.  Extrinsic 
stresses  are  those  originating  outside  the  immediate  environment  of  the 
part.  Intrinsic  stresses  are  those  functional  stresses  inherent  in  the 
functional  design  and  which  the  parts  were  designed  to  withstand.  Three 
categories  of  outcome  of  a  failure  event  are  indicated:  the  effect  on  the 
part,  the  consequence  to  the  system,  and  the  result  of  the  operational 
mission.  From  an  operational  viewpoint,  only  the  result  of  the  mission 
is  of  immediate  importance.  Maintenance  as  a  consequence  of  system 
malfunction  is  a  second -order  effect. 

Hence,  a  distinction  between  failure  and  malfunction  must  be  drawn 
in  the  case  of  propellers  and  their  controls  and  for  many  other  equipments. 

The  effect  of  each  possible  failure  on  the  component  should  be 
identified.  This  is  the  first  step  in  identifying  component  failures  with 
reliability  categories.  A  component  failure  may  cause  a  component  to  be 
completely  inoperative,  to  operate  in  an  erratic  fashion,  or  to  operate 
entirely  incorrectly.  A  broken  push  rod  or  a  vacuum  tube  with  a  burnt-out 
filament  would  be  examples  of  inoperative  components.  An  electric  relay 
with  an  eroded  contact  or  a  weakened  spring  such  that  it  occasionally 
operated  when  no  operation  was  desired  would  be  examples  of  erratic 
operation.  Examples  of  incorrect  operation  might  be  a  drift  in  the  value 
of  a  condenser  in  a  timing  circuit,  causing  a  change  in  the  time  constant  of 
the  circuit,  a  slipping  clutch,  or  a  leaking  hydraulic  valve. 

The  effect  of  each  possible  failure  on  the  operation  of  the  propeller 
control  should  then  be  identified.  As  an  example,  assume  that  a  switch 
that  actuates  the  emergency  feathering  of  a  propeller  fails  by  closing, 
perhaps  as  a  result  of  vibration,  when  closing  was  not  desired  by  the 
pilot.  The  effect  of  this  failure  upon  the  component  would  be  an  undesired 
operation.  The  effect  of  this  failure  on  the  propeller  control  would  be  an 
undesired  control  operation.  Drift  in  the  value  of  a  condenser  in  a  timing 
circuit  could  lead  to  a  lag  in  the  response  of  the  control,  A  slipping  clutch 
could  lead  to  an  incorrect  blade -angle  setting  by  the  control. 

Finally,  the  effect  of  a  component  failure  on  the  airplane  in  terms 
of  categories  of  reliability  previously  set  forth  must  be  identified.  Re¬ 
ferring  again  to  the  example  of  the  failure  in  the  emergency-feathering 
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switch,  this  failure  would  cause  feathering  of  the  propeller  and  loss  of 
power  from  the  engine.  For  a  multiengined  airplane,  this  failure  could 
be  no  more  serious  than  a  requirement  for  a  field-maintenance  action. 

There  is  not  a  sharp  "go-no-go"  or  failure  effect  for  the  vast  majority 
of  malfunctions.  Further,  reliability  must  be  evaluated  in  terms  of  its 
operational  effect  and  on  the  basis  of  the  intended  function  and  environment 
of  the  equipment.  Interdependency  of  part,  component,  and  system  mal¬ 
function  and  failure  is  a  distinct  characteristic  of  the  system  design.  The 
analysis  of  reliability  discussed  in  another  part  of  this  report  requires 
detailed  knowledge  of  these  relationships  and  the  effects  of  the  particular 
environmental  conditions  anticipated. 


Formal  Definitions  of  Reliability 


From  a  technical  point  of  view,  the  reliability  of  a  propeller  control 
is  the  probability  that  such  a  control  will  perform  for  some  unit  of  time 
without  malfunction  as  a  function  of  assigned  task,  environment,  and 
previous  history.  The  measure  or  yardstick  for  reliability  is  a  probability 
that  a  given  event  will  not  occur.  Even  for  a  single  well-defined  system, 
such  as  a  propeller -control  system,  there  are  many  possible  definitions 
of  the  terms  "perform",  "malfunction",  and  "assigned  task".  Thus, 
stemming  from  this  single  technical  definition,  there  are  a  large  number 
of  specific  definitions  of  reliability. 


Catastrophic  Reliability 

The  "catastrophic"  definition  of  reliability  is  already  recognized  at 
all  levels  in  the  USAF  and  among  the  contractors  as  the  single  most  im¬ 
portant  criterion  of  reliability.  No  matter  how  it  is  worded  or  referred  to, 
it  appears  in  the  thinking  and  actions  at  every  stage  of  development  and 
operation.  There  is  no  question  but  that  this  emphasis  is  correct. 

By  definition,  "catastrophic"  reliability  is  the  probability 
that  a  given  propeller  control  will  perform  for  a  period  of  time 
without  a  malfunction  resulting  in  catastrophic  consequences  for 
the  aircraft. 

Generally,  it  is  easier  to  state  this  in  terms  of  the  probability  that 
a  catastrophic  malfunction  will  occur.  The  smaller  this  number,  the 
more  reliable  the  system. 
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Emergency  Reliability 


The  next  most  important  definition  of  reliability  world  appear  to  be 
the  "emergency"  criterion. 

By  definition,  "emergency"  reliability  is  the  probability 
that  a  propeller  control  will  perform  for  a  period  of  time  without 
a  malfunction  requiring  manual  feathering  of  a  propeller  by  the 
pilot  or  other  equivalent  emergency  action. 

Typical  of  what  is  visualized  as  an  emergency  condition  equivalent  to  a 
manual  feathering  preventing  effective  use  of  a  turboprop  power  plant 
would  be  a  condition  of  complete  internal  control  failure,  resulting  in 
actuation  of  the  propeller  pitch  lock  and  loss  of  manual  feathering  capability. 


Maintenance  Reliability 

Two  maintenance  concepts  of  reliability  appear  to  be  important,  the 
"depot  maintenance"  concept  and  the  "field  maintenance"  concept. 

The  fraction  of  operating  controls  that  reach  the  mandatory 
overhaul  age  without  premature  removal  is  a  measure  of  the 
reliability  of  the  control  in  the  context  of  the  "depot  maintenance" 
concept  of  reliability. 

The  number  of  operating  hours  between  major  overhauls  at  the  depot 
may  be  thought  of  as  the  "operating  life"  of  the  control.  After  completing 
a  predetermined  number  of  operating  hours,  systems  such  as  the  propeller 
control  are  removed  from  the  aircraft  for  depot  overhaul.  This  pre¬ 
determined  number  of  hours  is  termed  the  mandatory  overhaul  period.  If 
a  control  exhibits  a  malfunction  that  cannot  be  repaired  by  line  or  field 
maintenance  before  reaching  the  mandatory  overhaul  period,  it  is  removed 
from  the  airplane  and  sent  to  the  proper  depot  for  overhaul.  This  action 
is  termed  a  premature  or  irregular  removal. 

Alternative  statements  of  this  concept  of  reliability  include  (a)  fraction 
of  systems  surviving  a  specified  number  of  flying  hours,  (b)  number  of 
flying  hours  a  specified  fraction  of  systems  are  expected  to  survive,  and 
(c)  the  fraction  of  systems  surviving  to  the  mandatory  overhaul  age. 

A  useful  operating  definition  of  reliability  in  terms  of  the 
"field  maintenance"  concept  is  the  number  of  malfunctions  that 
occur  per  1000  flying  hours  that  can  be  corrected  by  field 
maintenance. 

The  smaller  this  number,  the  greater  the  reliability  of  the  system. 
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Measure  and  Reliability 


The  numbers  used  to  describe  the  level  of  reliability  attained  or 
desired  are  not  numbers  that  can  be  arrived  at  by  direct  measurement. 
Rather,  these  numbers  represent  a  prediction  of  what  is  expected  to  happen 
or  not  to  happen  in  future  use  of  the  equipment  and,  hence,  must  be 
developed  by  some  logical  process  from  numbers  that  can  be  measured 
directly. 

As  in  every  statistical  study,  the  assignment  of  numerical  values 
to  reliability  and  related  concepts  depends  on  the  assumption  that  history 
repeats  itself.  The  life  history  is  recorded.  The  number  of  items  that 
fail  in  each  time  interval  are  then  tabulated  or  plotted  as  a  histogram.  In 
some  cases,  it  is  possible  to  represent  the  empirical  data  quite  accurately 
by  an  analytic  function.  The  result,  in  any  event,  is  a  failure -frequency 
distribution  function.  It  is  then  assumed  that  the  failure  pattern  in  the 
future  will  be  identical  with  that  observed  in  past  tests  or  operations. 

A  word  of  caution  is  in  order  to  be  certain  that  failure -frequency 
distribution  functions  such  as  those  shown  previously  in  Figures  1  and  2 
are  properly  defined.  It  is  common  practice  to  record  and  tabulate  the 
number  of  items  that  fail  in  a  given  unit  of  calendar  time  and  the  total 
number  of  items  operating  during  that  unit  of  calendar  time.  Such  a 
representation  of  failure  data  is  useful  for  a  number  of  management  control 
purposes,  but  not  for  reliability  considerations.  Except  in  the  special 
case  of  constant  hazard  rate  to  be  discussed  later,  failure  data  in  this  form 
do  not  permit  valid  estimation  of  the  measures  of  reliability.  The  data 
needed,  to  derive  Figures  1  and  2,  are  not  only  the  number  of  items  that 
failed  and  the  number  operating,  but  also  the  age  (hours  of  use)  of  each 
item  that  failed  and  the  age  of  each  item  that  did  not  fail.  *lore  accurately, 
then,  the  failure -frequency  distribution  should  be  prepared  by  tabulating 
the  number  of  failures  as  a  function  of  age,  rather  than  by  calendar  time. 
This  problem  usually  does  not  arise  in  the  interpretation  of  test  data  where 
the  items  are  started  on  tests  at  the  same  time. 

The  observed  number  of  failures  in  a  time  interval  may  be  divided 
by  the  number  of  items  in  the  original  group  to  give  a  failure -rate  descrip¬ 
tion  of  past  usage.  Almost  all  work  in  reliability  makes  the  following  (or 
some  equivalent)  very  important  assumption:  the  observed  failure  rate 
for  past  use  or  tests  is  the  best  estimate  of  the  failure  rate  to  be  expected 
for  future  usage.  Since  failure  rate  can  be  estimated  directly  from  ob¬ 
served  data,  all  of  the  concepts  related  to  reliability  that  are  discussed  in 
this  paper  are  stated  in  terms  of  the  failure  rate. 
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D efinitions  of  Concepts  Related  to  Reliabili 


Failure  Rate,  If  a  group  of  virtually  identical  items,  n(o),  is  as¬ 
sumed  to  have  started  operation  at  time  t  «  0,  with  some  number,  n(t), 
surviving  to  time  t,  then  the  failure  rate,  Y(t),  is  defined  as  the  ratio  of 
the  number  expected  to  fail  in  a  unit  of  time  At  at  time  t  to  the  initial 
number  of  units.  This  quantity  is  also  called  the  failure -probability  density 
function.  In  the  general  case,  failure  rate  is  a  function  of  the  number  of 
hours  the  item  has  operated  and  is,  hence,  a  function  of  time  in  the  sense 
of  age  of  the  items.  Failure  rate  is  also  a  function  of  kind  of  unit  of  time 
chosen  as  a  measure.  Failure  rate  per  hour  and  failure  rate  per  minute 
are  quite  different  numerically,  even  though  they  describe  the  expected 
failure  rates  of  the  same  item. 


Thus, 


Y(t)  = 


n(t)-n(t  +  At) 
At 


'  '  n(o)  At 

and  in  the  limit  as  At  -*■  0, 

Y(t)  <1'> 

Hazard  Rate.  The  hazard  rate  is  defined  as  the  ratio  of  the  number 
of  failures  expected  in  a  unit  of  time  to  the  number  of  items  of  equipment 
operating  during  the  unit  of  time.  In  other  words,  it  is  the  probability  that 
an  item  will  fail  in  a  given  unit  of  time.  In  the  general  case,  hazard  rate 
[Z  (t)]  is  a  function  of  the  number  of  time  units,  e.g. ,  hours,  the  item  has 
operated  and  is,  hence,  a  function  of  time. 


Thus, 


Z(t)  s  1  n(  t)  -n(  t  +  At) 

n(  t)  At 

and  in  the  limit  as  At  -»  0 


z(t)  =  -  _ L_  .  .  ( 

n(  t)  dt 

Hazard  rate  is  frequently  used  and  referred  to  as  a  measure  of  the 
reliability  of  an  item.  It  is  of  use  when  failures  are  relatively  frequent, 
and  the  total  maintenance  and  item-replacement  load  are  of  interest. 
Maintenance  incidents  for  1000  hours  of  use  and  replacement  parts  re¬ 
quired  per  1000  hours  of  use  are  examples  of  hazard  rates. 


Probability  of  Survival.  The  probability  of  survival,  S(t),  is  the 
probability  that  a  given  item  will  survive  from  start  of  operation  to  some 
time  t.  This  quantity  is  also  the  ratio  of  the  number  of  virtually  identical 
items,  n(t),  expected  to  survive  to  time  t  to  the  number  of  items,  n(o),  that 
started  operations  at  time  t  =  0. 
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Thus, 


s(t)  =  > 

n(o) 


S(t)  =  1  -  C  t  Y(t)dt  . 

J0 

The  probability  of  an  item  not  surviving,  U(t),  is  then 


U(t)  =  1  -  S(t)  =  1 


n(o) 


U(t)  =  C*  Y(t)dt  . 

J0 

The  function  U(t)  is  the  cumulative  failure  distribution. 


(3) 

(3*) 


(4) 

(41) 


The  fraction  of  a  given  number  of  items  that  may  be  expected  to 
survive  a  given  number  of  hours  of  use  is  an  important  consideration  in 
scheduling  overhaul  facilities  and  planning  the  pui  chase  of  spares  and  re¬ 
placements.  This  fraction  is  the  survival  probability  for  the  number  of 
hours  of  use  of  interest. 


The  half-life  may  be  defined  as  the  number  of  hours  of  usage  that  a 
new  item  has  a  50  per  cent  chance  of  achieving  or,  by  the  equivalent  defini¬ 
tion,  as  the  number  of  hours  of  usage  at  which  50  per  cent  of  a  group  of 
items  may  be  expected  to  survive.  Thus,  the  half-life  is  that  time  at  which 
the  survival  probability,  S(t),  is  one-half. 


Relationships.  It  is  apparent  that  hazard  rate,  Z(t),  failure  rate, 
Y(t),  and  probability  cf  survival,  S(t),  are  related.  The  product  of  Z(t), 
Equation  (2'),  and  S(t),  Equation  (3),  is  equal  to  Y(t),  Equation  (l1): 

Y(t)  =  Z(t)  S(t)  ,  •  (5) 


Y(t)  =  Z(t)  [1  -  U(t)]  . 

Examination  of  Equations  (41)  and  (4)  makes  it  apparent  that: 

Y(t)  [U(t)]  , 
d 


Hence, 


=  £[1  . 
d 


Z(t)  = 


it  [U(t)1 

.1-  U(t) 


(51) 

(6) 

(6‘) 

(7) 
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Reliability,  Although  many  different  definitions  of  reliability  are  in 
use,  one  definition  is  gradually  gaining  common  acceptance  as  a  basis  for 
quantitative  statements  as  to  the  reliability  of  machines  and  equipment. 

Reliability  is  the  probability  that  an  item  or  a  system  will  perform 
its  assigned  task  for  a  period  of  time  v/ithout  malfunction  as  a  function  of 
the  assigned  task,  environment,  and  previous  history. 


Reliability  is  measured  in  terms  of  the  probability  that  a  given  event, 
a  failure,  will  not  occur.  However,  the  terms  "perform",  "malfunction", 
and  "assigned  task"  have  many  possible  definitions.  Thus,  stemming  from 
this  single  general  definition,  there  are  a  large  number  of  specific  defini¬ 
tions  of  reliability. 


Reliability,  R(t),  by  this  definition  is  the  probability  of  survival  over 
a  given  period  of  time  t^  to  t^. 

n(t?) 

Thu*,  R<»  -  , 

n(t2)  /n(o) 

”  n(tj)  /n(o) 


Using  Equation  (3): 


R(t)  = 


S(t,) 
S(tj)  ’ 


or  using  Equation  (3'): 


1  -  J*2  Y(t)dt 

R(t)  =  - ^ -  (8) 

1  -  \  Y  ( t)  dt 

J0 


Mean  Time  to  Failure.  If  it  is  assumed  that  a  group  of  items  is 
operated,  or  tested,  until  all  have  failed,  then  the  mean  or  average  time 
to  failure,  T,  is  the  sum  of  the  individual  times  to  failure  divided  by  the 
total  number  of  items  observed. 


Thus, 


T 


nfo-y 


(tl  +  t2  +  t3  + 


^(o))  • 


(9) 


Since  n(o)Y(t)  is  the  number  of  items  failing  in  an  infinitesimal  interval 
of  time  t. 


T 


_  1 
”  n(o) 


(10) 
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This  quantity  T  is  also  the  expected  life  of  the  system. 


(id 


If  each  item  in  the  group  is  replaced,  or  repaired  and  returned  to 


service,  upon  failure,  then  is  the  expected  interval  of  time  between 


failures,  and  T  is  the  expected  interval  between  failures  for  any  one 
system.  Replacement  of  failed  parts  is  normal  to  most  operations.  Hence, 
T  in  the  context  of  average  time  between  failures  is  useful  as  a  guide  to 
estimating  maintenance  requirements. 


Some  Specific  Failure  Patterns 

If  the  data  necessary  for  estimation  of  th^  failure  rate,  the  failure - 
frequency  distribution  and  the  number  of  items  in  use  as  a  function  of  age, 
are  available  as  empirical  data,  any  of  the  other  functions  related  to 
reliability  can  be  calculated  directly.  Such  data  are  available  when  there 
is  an  extensive  body  of  operational  history  or  test  experience. 

However,  for  much  reliability  study,  it  is  necessary  to  estimate 
reliability  when  no  body  of  empirical  information  is  available.  It  is  then 
desirable  to  express  reliability  functions  analytically.  It  has  been  ob¬ 
served  by  a  number  of  investigators  in  the  field  of  reliability  that  one  or 
the  other  of  the  following  two  analytic  representations  fits  much  observed 
data  rather  well:  constant  hazard  rates  [Z(t)  a  constant]  and  a  normal 
or  Gaussian  failure  rate  [Y(t)  a  function  of  time].  Most  real  sets  of 
empirical  data  for  complex  systems  indicate  that  the  best  representation 
of  reality  can  be  achieved  by  combining  these  two  analytic  expressions  with 
an  empirical  "infant  mortality"  hazard  rate  in  such  a  manner  that  each 
pattern  of  failure  is  dominant  in  a  different  period  in  the  life  of  the  system. 
Each  of  these  patterns  and  the  combination  of  all  three  patterns  are  dis¬ 
cussed  separately  in  the  following  sections. 


Constant  Hazard  Rate.  The  simplest  hazard  rate  is  the  case  in  which 
Z(t)  s=  a,  a  constant.  This  is  equivalent  to  assuming  that  an  item  has  an 
equal  chance  of  failing  in  any  time  period.  The  failures,  then,  are  random 
in  time.  Making  this  substitution  in  Equations  (7)  and  (4)  with  t  *  0, 
tj  s  t  gives 

S(t)  -  e~at  .  (12) 
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Hence,  this  failure  pattern  is  frequently  described  as  exponential.  Conse¬ 
quently,  when  a  is  known,  the  reliability  at  any  time  can  be  found,  The 
forms  of  Z(t),  S(t),  and  Y(t)  for  this  failure  pattern  are  shown  in  Figure  3. 

For  the  exponential  law,  as  is  used  here,  the  distribution  function 
becomes  f(t)  =  N  a  e”a^  and  mean  time  to  failure  becomes 

T  ^°°N  ate-atdt  =  -i.  (13) 

Thus,  the  mean  time  to  failure  is  the  reciprocal  of  the  hazard  rate. 


In  the  case  of  systems  in  which  no  replacements  are  made,  the 
survival  probability  of  the  set  of  systems  at  t  -  T  is  S  *  —  =  0.  37.  This 
indicates  that  the  survival  probability  of  the  population  at  mean  time  to 
failure  is  0.  37,  or  37  out  of  100  systems  survive  at  t  =  T,  Quite  often 
mean  time  to  failure  is  defined  by  this  fact.  Thus,  mean  time  to  failure  is 
that  time  at  which  S  =  0,  37. 


Gaussian  Failure  Rate.  As  the  system  population  ages,  the  compo¬ 
nents  and,  consequently,  the  system  may  wear  out  or  show  evidence  of 
fatigue  failures.  This  happens  more  or  less  uniformly  to  all  systems. 


The  hazard  rate,  in  this  case,  increases  rapidly  near  the  end  of  life 
of  the  population.  Since  hazard  rate  is  the  ratio  of  failures  to  survivors, 
its  maximum  value  is  one.  The  hazard  rate  due  to  fatigue  failure  ap¬ 
proaches  one  near  the  end  of  the  life  of  the  systems.  This  observed 
phenomenon  may  be  approximated  by  assuming  that  Y(t)  is  normally  dis¬ 
tributed  about  some  mean,  b,  with  standard  deviation  s.  Then: 


Y(t)  » 


bVZjT 


2 


The  forms  that  Y(t),  Z(t),  and  S(t)  take  for  this  failure  pattern  are  illus¬ 
trated  in  Figure  4.  The  mean  time  to  failure, T,  is  by  definition  equal  to  b. 


Infant  Mortality  Rate.  When  a  group  of  systems  first  begins  to 
operate,  some  will  fail  immediately  or  at  least  in  a  very  small  time  in¬ 
terval  at  the  beginning  of  the  operating  interval.  This  is  similar  to  the 
mortality  rate  of  infants:  as  time  increases,  the  number  of  deaths  de¬ 
crease.  Because  of  this  resemblance,  this  type  of  failure  rate  is  called 
"infant  mortality  rate*1.  The  form  taken  by  S(t),  Z(t),  and  Y(t)  for  the 
infant  mortality  pattern  is  shown  in  Figure  5, 
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In  order  to  calculate  R  at  any  point,  Z  must  be  defined.  This  is 
usually  done  by  curve-fitting  methods. 


Application  of  Reliability  Theory 
to  Propeller  Controls 

In  this  report,  "catastrophic1*  reliability  was  defined  as  the  proba¬ 
bility  that  a  given  propeller  system  will  not  exhibit  a  malfunction  in  a 
stated  number  of  operating  hours  that  could  lead  to  catastrophic  conse¬ 
quences  for  the  aircraft.  It  is  general  practice  to  state  this  number  in 
terms  of  the  probability  that  a  catastrophic  malfunction  will  occur  (i.  e.  , 
unreliability);  the  smaller  the  number,  the  more  reliable  the  system. 

The  definition  of  "emergency**  reliability  presented  in  this  report 
was  the  frequency  of  propeller -control  malfunctions  requiring  manual 
feathering  of  a  propeller  by  the  pilot  or  other  equivalent  emergency  action. 
Again,  unreliability  is  used  as  a  yardstick  for  reliability,  and  the  smaller 
the  number,  the  more  reliable  the  system. 

The  fraction  of  operating  controls  that  reach  the  mandatory  overhaul 
age  without  premature  removal  is  a  measure  of  the  reliability  of  the 
control  in  the  context  of  the  depot-maintenance  concept  of  reliability. 

The  definition  of  field-maintenance  reliability  was  stated  (in  terms 
of  unreliability)  as  the  number  of  malfunctions  that  occur  per  1000  flying 
hours  that  can  be  corrected  by  field  maintenance;  the  smaller  this  number, 
the  greater  the  reliability  of  the  system. 

The  first  of  these,  catastrophic  reliability,  would  be  represented, 
as  phrased,  by  the  symbol  R,  as  defined  earlier  in  this  report.  The 
emergency  and  field-maintenance  definitions  of  reliability  are  actually 
stated  in  terms  of  the  hazard  rate,  Z(t).  The  depot-maintenance  definition 
of  reliability  is  stated  in  terms  related  to  S(t). 

These  relationships  can  best  be  interpreted  by  assuming  a  specific 
failure  pattern.  The  assumption  that  hazard  rate  is  a  constant,  almost 
certainly  a  different  constant,  for  each  concept  of  reliability  will  serve. 


Catastrophic  Reliability. 

Assume  ZQ(t)  =  a  , 


Rc  B  e 
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Rc  .  e'a(t2  '  *1*  . 

The  probability  of  a  catastrophic  malfunction  on  the  next  flight  is 
exponentially  related  to  the  hazard-rate  constant  and  the  duration  of  the 
next  flight. 

Emergency  Reliability. 

Assume  Ze(t)  =  b, 

where  Ze(t)  is  the  expected  frequency  of  emergency  malfunctions. 

Field-Maintenance  Reliability, 

Assume  Zf(t)  =  c, 

where  Zf(t)  is  the  expected  rate  of  field-maintenance  incidents. 

Depot-Maintenance  Reliability. 

Assume  Z^(t)  =  d, 

Sd(t)  =  e-dt  , 

where  S^(t)  is  the  fraction  of  the  initial  population  expected  to  survive 
to  time  t. 


Reliability  and  Catastrophic  Failure 


Catastrophic  reliability  has  been  defined  (Reference  4)  as  the 
probability  that  a  propeller  control  will  perform  for  a  period  of  time  without 
a  malfunction  resulting  in  a  catastrophic  loss  of  the  aircraft.  Propeller 
controls  are  vital  elements  of  an  aircraft  upon  which  safety  or  flight  de¬ 
pends  and  therefore  can  be  directly  responsible  for  loss  of  the  aircraft  in 
the  event  of  failure.  Similar  elements  affecting  safety  of  flight  are  the 
engines,  flight  controls,  and  of  course  the  primary  structure,  such  as  the 
wings.  It  has  been  pointed  out  (Reference  31)  that  an  acceptable  failure 
rate  for  the  primary  structure  is  of  the  order  of  1  x  10"^  per  hour.  This 
value  is  also  approximately  the  number  of  commercial  airline  catastrophic s 
experienced  per  flying  hour. 
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The  vital  elements  of  structure,  power  plant,  and  flight  control 
operate  independently  of  one  another.  It  seems  reasonable  then  to  expect 
the  catastrophic  failure  rate  of  any  one  element  to  be  not  less  than  1  x  10"? 
per  hour. 


Concept  of  Redundancy 


The  objective  of  redundancy  is  to  design  equipment  to  operate 
satisfactorily  in  spite  of  failure  of  certain  critical  parts.  Reliability 
of  military  equipment  has  been  achieved  in  the  past  largely  through  re¬ 
dundant  design  and  high  safety  factors  in  strength  of  materials.  Es¬ 
pecially  in  manned  aircraft,  redundancy  is  credited  (Reference  7)  with 
achieving  suitable  reliability.  Thus,  in  redundant  designs,  even  though 
failure  may  occur  relatively  often,  the  ratio  of  malfunction  to  catastrophic 
failure  is  extremely  large,  i.e.  ,  10,000  to  1. 

Manned  aircraft  possess  inherent  redundancy  wherever  a  crew 
member  retains  manual  control  over  an  equipment  function  in  the  event  of 
failure.  Only  in  cases  where  human  capabilities  cannot  cope  with  the 
problem  manually,  such  as  the  reverse -thrust  phenomena  in  propeller 
control,  has  the  presence  of  a  human  control  loop  failed  to  improve  re¬ 
liability  significantly  with  respect  to  catastrophic  failure  or  mission 
success. 

In  general,  it  can  be  said  that  military  aircraft  design  practice  has 
admitted  the  success  of  redundancy  and  encouraged  its  use.  Although  not 
often  explicitly  stated,  the  official  design  guidance  in  the  form  of  hand¬ 
books  and  specifications  tacitly  implies  the  acceptance  of  redundancy.  The 
"fail-safe"  concept  of  operation  is  an  example.  Despite  weignt  penalties 
and  increased  maintenance,  redundancy  has  proved  to  be  a  satisfactory 
solution  in  many  respects  to  the  attainment  of  high  reliability.  One  bad 
effect,  however,  has  been  to  reduce  the  emphasis  on  study  of  the  essential 
characteristics  of  failure  in  various  applications. 

Redundancy  has  a  substantial  impact  on  the  observable  effects  of 
certain  types  of  failure  and,  hence,  on  field  testing  and  evaluation  of 
equipment.  For  example,  in  propeller  controls,  the  reverse -thrust 
situation  inherent  in  most  controls  is  avoided  through  the  use  of  pitch 
locks,  low-pitch  stops,  negative  torque  correction,  and  automatic  feather¬ 
ing  devices  paralleling  the  main  control  elements.  Thus,  an  internal 
failure  that  could  generate  emergency  conditions  may  not  be  observed.  The 
resulting  action,  automatic  or  otherwise,  to  feather  the  propeller  may  not 
be  attributed  to  the  actual  cause  in  later  analysis.  The  same  is  true  for 
malfunctions  resulting  in  transfer  of  control  from  the  automatic. 
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self- regulating  devices  to  the  pilot.  The  common  reasons  given  for  such 
action  are  mildly  fluctuating  propeller  speed  or  off- speed  operation,  and 
these  do  not  give  any  positive  indication  of  the  source  or  ultimate  result 
of  failure. 


Catastrophic  Failure  Events 
The  Multiengine  Case 

Redundancy  has  a  significant  effect  on  the  consequences  of  failure 
and  hence  on  the  relative  frequency  of  catastrophic  results  for  a  given 
design.  Redundancy  has  been  accepted  as  an  expedient  measure  in  at¬ 
taining  safety  of  flight.  It  is  widely  used  in  the  design  of  aircraft  hydraulic, 
flight -control,  and  electronic  systems.  In  the  following  paragraphs,  an 
attempt  will  be  made  to  show  the  effect  of  design  redundancy  on  propeller - 
control  reliability  in  the  context  of  the  four -engine  aircraft  configuration. 

Catastrophic  failures  attributable  to  the  propeller  control  can  occur 
in  any  of  several  ways: 

(1)  Simultaneous  failures  of  an  emergency  nature,  not  catastrophic 
in  themselves  but  in  combination,  such  that  thrust  from  more 
than  two  engines  is  lost 

(2)  Failure  of  a  single  critical  component  or  part  such  that 
secondary  effects  are  catastrophic: 

(a)  Negative  thrust,  leading  to  loss  of  aerodynamic 
control  of  the  aircraft 

(b)  Vibration  leading  to  primary  structural  fatigue 
and  failure 

(c)  Vibration  leading  to  blade  rupture,  thrown  parts, 
and  possibly  fire. 

In  the  first  case,  consider  each  propeller  control  to  be  one  integral  unit 
independently  affecting  the  operation  of  each  power  plant.  The  probabili¬ 
ties  of  emergency- type  failure  of  the  set  of  four  controls  involving  failures 
such  as  loss  of  governing  or  hydraulic -valve  failure  or  mechanical  failure 
of  the  pitch-change  mechanism,  and  others  (Reference  4),  are  defined  as 
follows: 

Pi  c  Pr  I  Pi  f  =  probability  of  a  single  propeller -control 

^  ^  failure 
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pu  ■ p>  {Fipj}  - 

pijk  =pr{FipjFk}  ■ 
Pijkl  -  pr  {FiFjFkFl}  ■ 


probability  of  two  simultaneous  propeller- 
control  failures 

Probability  of  three  simultaneous  propeller- 
control  failures 

Probability  of  four  simultaneous  propeller- 
control  failures. 


Now,  from  combinatorial  analysis,  all  possible  combinations  must 
be  considered  and  overlapping  cases  eliminated. 

Let  S1  =  ^  Pi>  S2  =  £  Pij’  S3  "  ^  Pijk»  and  S4  ■  Y,  Pijkl* 

Then  the  probability,  P^,  of  at  least  one  failure  among  all  possible 
events  is 


P1  =  S1  -  s2  +  S3  “  S4* 

In  the  four -engine  case,  assuming  all  controls  are  identical: 

Pl  =  4Pi  -  6Pi2  +  4Pi3  -  P^. 

When  P.  «  1, 

1  9 


Thus,  the  probability  of  at  least  one  emergency  failure  when  four 
controls  are  present  is  approximately  four  times  the  probability  of  failure 
for  a  single  control. 

However,  aircraft  equipped  with  four  turboprop  engines  are  normally 
capable  of  emergency  flight  operation  on  only  two  engines.  At  least  three 
must  be  lost  before  the  failure  becomes  catastrophic. 

There  are  four  possible  ways  that  three  controls  can  fail  simul¬ 
taneously.  The  probability  of  multiple,  simultaneous  failure  is  then 


Approximate  values  for  probabilities  of  simultaneous  occurrence  of 
emergency-type  failures  are  shown  in  Table  3.  To  meet  the  catastrophic 
reliability  requirement  of  not  more  than  one  occurrence  of  three 
simultaneous  control  failures  in  10“^  hour,  the  probability  of  failure  for 
individual  controls  must  be  in  the  range  0.001  <  P^  <  0.01.  A  specific 
value  of  P^  satisfying  the  equality  P3  »  4  (Pj)^  is  0.00292  per  hour. 
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TABLE  3.  PROBABILITY  OF  SIMULTANEOUS  OCCURRENCE  OF 
EMERGENCY-TYPE  FAILURES 


Number  of  _ Probability  of  Control  Failure _ 

Engines  Lost  Pi  a  0.  I  Pi  =0.01  Pi  =0.001 


1 

4.641 x  10"1 

~4  x  10“2 

~ 4  x  10“3 

2 

6.41  x  10“2 

~  6  x  10“4 

~6  x  10"6 

3 

4.  1  x  10-3 

~4  x  10“6 

~ 4  x  10“ 

4 

1  x  10-4 

~  1  x  10*8 

~ 1  x  10-12 

The  time  dependence  expressed  here  and  elsewhere  in  this  section 
arises,  not  from  any  time  dependence  of  the  failure  function,  which  is 
independent  of  time  in  the  random -failure  region,  but  from  the  incidence 
of  causes  that  are  time  dependent. 

In  the  second  case,  failure  of  a  critical  component  causes  secondary 
effects  that  can  be  catastrophic,  such  as  negative  thrust  or  vibration 
damage.  This  is  the  case  where  failure  of  a  single  control  has  catastrophic 
consequences.  In  this  case,  redundancy  within  the  control  itself  is  of 
primary  interest.  The  basic  components  in  a  propeller  control  are  usually 
considered  to  be  in  series;  that  is,  all  are  required  to  function  without 
failure  if  the  control  is  not  to  fail.  The  probability  of  successful  system 
operation  in  a  series  arrangement  is  the  product  of  the  probabilities  of 
successful  operation  of  the  components.  This  is  often  called  the  nproduct 
rule"  and  is  expressed  as 

Probability  of  system  operation  =  (P^)  (P£)  (P3)  ....  (Pn)  , 

where  P  is  the  probability  of  successful  component  operation  and  n  is  the 
number  of  components  in  series.  In  this  sense,  the  system  resembles  a 
chain  in  which  any  single  element  with  poor  reliability  substantially  de¬ 
grades  the  entire  system.  The  components  in  such  a  system  would  need 
to  have  failure  rates  at  least  an  order  of  magnitude  lower  than  the  required 
minimum  system  failure  rate.  Fortunately,  the  propeller -control  designs 
presently  in  existence  are  not  of  this  sort,  but  contain  both  series  and 
parallel  components  arranged  in  redundant  fashion  so  as  to  achieve  the 
high  catastrophic  reliability  level  required. 

To  estimate  the  reliability  of  a  complex  system,  a  functional 
definition  of  the  system  must  be  carefully  devised  so  as  to  show  clearly 
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the  true  relationship  of  the  components  in  accomplishing  the  system  function. 
This  is  a  most  important  first  step  in  the  reliability  analysis.  In  Figure  6, 
several  functional  diagrams  of  propeller -control  arrangements  are  shown. 

In  the  following  paragraphs,  the  effects  of  the  redundancy  illustrated  in 
Figure  6  are  discussed. 

The  basic  components  in  a  propeller  control,  Figure  6a,  are  the 
governing  mechanism  and  the  pitch- change  mechanism.  These  can  be 
considered  to  be  functionally  in  series,  since  both  must  operate  in  se¬ 
quence  if  the  control  is  to  operate  successfully.  The  catastrophic 
reliability  of  this  system  in  turboprop  applications  is  particularly  sensitive 
to  the  component  reliabilities,  since  a  failure  can  lead  directly  to 
catastrophic  consequences.  If  each  of  the  two  basic  components  has  a 
probability  of  failure  of  1  x  10“^  per  hour,  the  probability  of  catastrophic 
failure  approaches  2  x  10 per  hour.  To  achieve  an  acceptable  level  of 
reliability,  each  would  need  to  be  developed  to  the  point  where  probability 
of  failure  was  less  than  1  x  10"®,  If  the  probabilities  of  failure  were  not 
equal,  one  probability  would  need  to  be  even  less  than  1  x  10"®.  The 
present  state  of  the  art  in  airborne  systems  design  does  not  appear  capable 
of  producing  such  designs,  now  or  in  the  near  future. 

In  actual  practice,  a  form  of  redundancy  aimed  specifically  at  re¬ 
ducing  catastrophic  failure  and  increasing  safety  of  flight  makes  possible 
the  realization  of  acceptable  systems.  One  example  is  shown  in  Figure  6b. 
By  introducing  safety  devices  in  the  form  of  pitch  locks,  low-pitch  stops, 
and  negative  torque  control,  along  with  the  inherent  redundancy  available 
with  the  pilot  in  manned  aircraft  systems,  it  becomes  possible  essentially 
to  parallel  all  vital  components.  In  the  event  of  failure  in  the  arrangement 
shown  in  Figure  6b,  there  are  two  backup  components  for  each  of  the 
functional  operations  to  prevent  catastrophic  consequences  in  the  event  of 
component  failure. 

The  reliability  of  the  complex-redundant  system  in  Figure  6b,  as¬ 
suming  independent  operation  for  each  component,  can  be  expressed  as 

F  *  [  1-  (1-Pi)  <1-P2)  (1-P3)]  [  1-  (I-P4)  U-P5)  U-P6)]  , 

where  P  is  the  component  reliability.  For  purposes  of  illustration,  assume 
all  component  reliabilities  are  equal  and  the  probability  of  failure  associated 
with  each  is  0.0030. 

Then 


P  =  [  1-  (1-0.  997)3]2 
=  0.999  999  946. 
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FIGURE  6.  FUNCTIONAL  DIAGRAMS  OF  PROPELLER  CONTROL 
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The  probability  of  catastrophic  failure  of  a  system  for  the  functional  con¬ 
figuration  defined  in  Figure  6b  is 

1  -  P  =  5.4  x  10"8  <  1  x  10"7  . 

Thus,  the  redundant  design  appears  to  be  acceptable  in  terms  of  catas¬ 
trophic  reliability.  In  this  case,  where  all  component  reliabilities  are  equal, 
it  makes  little  difference  how  redundancy  is  effected  as  long  as  both  vital 
elements  are  paralleled  by  at  least  two  other  components. 

If  each  vital  component  is  paralleled  only  once,  the  probability  of 
catastrophic  failure  increases  to  1.8  x  10"^.  If  no  redundancy  is  em¬ 
ployed,  the  probability  of  catastrophic  failure  is  6  x  10“^.  Hence,  the 
functional  requirements  stemming  from  safety  considerations  have  also 
served  to  provide  the  necessary  margin  of  reliability  in  terms  of 
catastrophic  consequences. 

Obviously,  the  probabilities  of  failure  for  all  components  in  existing 
propeller  controls  are  not  equal,  nor  is  the  over -all  problem  so  simple 
as  the  example  above.  However,  experience  is  not  too  different  from  the 
hypothetical  case.  One  would  normally  expect  engineering  experience 
to  be  sufficient  to  design  most  propeller -control  components  with  prob¬ 
abilities  of  failure  less  than  0.010,  or  the  equivalent  of  one  expected 
failure  in  each  100  hours  in  the  random-failure  region.  Safety  devices  and 
emergency  backup  components  could  reasonably  be  expected  to  have 
probabilities  of  failure  less  than  0.0010.  With  these  reliability  values, 
the  configuration  in  Figure  6b  is  estimated  to  have  a  probability  of 
catastrophic  failure  of  1.8  x  10“^,  reasonably  close  to  the  desired  value. 

If  the  probability  of  failure  of  one  of  the  two  vital  components  is 
reduced  to  0.0050,  the  probability  of  catastrophic  failure  decreases  to 
1.  35  x  10-7.  Alternatively,  if  one  additional  safety  device  is  inserted 
paralleling  either  or  both  of  the  vital  components,  as  in  Figure  6c,  the 
probability  of  catastrophic  failure  decreases  a  larger  amount,  to 
9.03  x  10-8. 

Should  only  one  vital  component  be  inserted  into  the  functional  se¬ 
quence,  Figure  6d,  in  such  a  way  as  to  be  outside  that  portion  of  the 
system  paralleled  by  safety  devices,  the  effect  of  redundancy  is  nullified. 
Assuming  the  component  reliabilities  expected  from  engineering  experience 
as  above,  the  probability  of  catastrophic  failure  for  the  configuration  in 
Figure  6d  would  be  1.  1  x  10“^,  or  just  slightly  less  than  the  component 
reliability  itself. 

Again,  in  Figure  6b,  introducing  a  switch  with  a  fairly  high  failure 
probability,  say  0.020,  in  series  with  each  safety  device  reduces 
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catastrophic  reliability  by  several  orders  of  magnitude.  Assuming  the 
same  component  reliability  as  above,  based  on  engineering  experience,  the 
probability  of  catastrophic  failure  increases  to  approximately  1  x  10 -5, 

Naturally,  redundancy  does  not  achieve  its  desired  goal  without  some 
associated  penalty.  From  the  maintenance  standpoint,  additional  compo¬ 
nents  introduce  greater  numbers  of  individual  failures  and  inevitably  in¬ 
crease  the  burden  of  maintaining  the  equipment.  In  view  of  the  relatively 
low  component  failure  rates  required  in  this  type  of  equipment,  however, 
this  does  not  appear  to  be  a  serious  problem. 


Vital  and  Critical  Components 

The  terms  ,,vitalu  and  "critical"  components  have  been  used  to 
describe  the  basic  elements  in  the  propeller-control  system.  In  view  of 
the  above  discussion,  the  following  definitions  are  given: 

A  vital  component  is  one  that  must  be  paralleled  or  backed 
up  by  one  or  more  safety  devices  in  order  to  achieve  the  re¬ 
quired  minimum  probability  of  catastrophic  failure  for  the  system. 

A  critical  component  is  one  for  which  the  catastrophic 
consequences  of  failure  cannot  be  overcome  through  redundant 
design  and  that  exhibits  a  conditional  probability  of  catastrophic 
failure  in  the  event  of  malfunction  greater  than  1  x  10 

In  the  present  state  of  the  art  in  aircraft  systems  design,  vital 
components  are  common.  The  use  of  redundancy  to  overcome  the  tendency 
toward  catastrophic  consequences  is  likewise  prevalent  in  practice.  The 
important  steps  in  evaluating  the  adequacy  of  the  design  are: 

(1)  Correct  functional  definition  of  the  system 

(2)  Determination  that  redundant  components  are  in  fact  in¬ 
dependent  of  the  basic  functional  sequence 

(3)  Determination  of  the  validity  of  the  estimated  component 
reliabilities  or  failure  probabilities. 

One  critical  component  can  control  the  incidence  of  catastrophic 
consequences  in  a  system.  Generally,  there  is  some  major  design 
deficiency  that  must  be  eliminated  from  either  the  basic  system  design 
or  the  component  design.  For  redundant  systems  encountered  in  aircraft, 
the  ratio  of  failure  to  disaster  is  probably  at  least  10,000  to  1  (Reference  7). 
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For  the  systems  discussed  in  the  preceding  paragraphs,  this  ratio  is  more 
nearly  100,000  to  1.  One  critical  component  can  make  catastrophic 
failure  100,000  times  as  probable. 

The  propeller  blades,  hub,  gears,  and  shafts  are  prime  examples  of 
critical  components.  Propeller  controls  are  not  in  the  sequence  of  force 
transmission  that  is  so  difficult,  if  not  impossible,  to  parallel.  Thus,  it 
is  unlikely  that  a  critical  component  need  exist  in  the  control  design. 
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WADC  Qualification  Test  Evaluation 


Description  of  Tests 

In  order  to  provide  a  basis  for  suggesting  future  test  modification  and 
standardization,  a  general  study  of  WADC1  s  propeller-control-system 
qualification- testing  procedures  has  been  made.  The  major  aim  of  this  study 
was  to  determine  the  nature  of  the  information  being  obtained  from  the 
present  qualification  tests.  A  statistical  estimate  of  the  confidence  that  can 
be  placed  in  the  control  system  from  the  information  received  has  been 
included. 

Test  phases  that  provide  information  for  estimating  control- system 
reliability  are  listed  on  WADC-O  Form  412  as  follows: 

(1)  Electric  Motor  Whirl  Rig  Test 

(2)  Full  Scale  Engine  Test 

(3)  Environmental  Tests 

(4)  Functional  Tests 

(5)  Simulator  Test 

Four  prototype  control  systems  are  provided  for  test  purposes  —  one 
for  each  of  the  first  four  tests.  The  fifth  test  involves  analog  simulation  of 
the  system.  The  remainder  of  this  discussion  will  consider  these  five  tests. 

Electric  Motor  Whirl  Rig  Test.  In  this  test,  the  propeller,  with  blades 
installed,  is  driven  by  an  electric  motor.  The  purpose  of  the  test  is  to  check 
the  functional  suitability  of  the  system,  that  is,  to  see  whether  the  propeller 
system  performs  in  accordance  with  the  purchase  specification  requirements. 
The  test  normally  includes  surveys,  calibrations,  20  hours  of  endurance 
running,  and  1  hour  of  over  speed  running. 

Ideally,  the  information  from  this  test  is  relevant  to  the  following 
questions: 

(1)  Does  the  system  deliver  the  desired  thrust  under  ideal 
operating  conditions? 
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(2)  Does  the  system  demonstrate  the  capability  to  withstand 
operating  stresses  under  ideal  operating  conditions? 

(3)  What  failure  rate  and  pattern  (infant  mortality)  are  observed 
during  the  first  few  hours  of  operation? 

(4)  Are  the  components  of  the  system  compatible?  (Conversely, 
are  there  any  failures  because  the  components  do  not  fit 
together  properly,  because  of  unequal  expansion  due  to 
heat,  etc.  ?) 

(5)  What  types  of  failure  (vital,  critical,  subcritical)  are 
observed  ? 

Simulator  Test.  In  this  test,  the  functions  of  the  system  are  duplicated 
by  an  analog  computer.  The  load  and  design  parameters  of  the  system  are 
varied  to  determine  the  limits  of  operation.  These  tests  are  pertinent  to  the 
following  questions: 

(1)  What  is  the  time  of  response  of  the  system  to  commands  and 
feedback  signals?  Are  the  transients,  stability,  etc.  ,  as 
specified  in  the  design? 

(2)  What  are  the  theoretical  operating  limits  of  the  system? 

(For  instance,  what  is  the  maximum  load  under  which  the 
control  will  operate  within  tolerance?) 

(3)  What  is  the  theoretical  force  loading  on  the  major  subassemblies? 

Data  collected  here  provide  a  basis  for  comparing  functional  suitability 
observed  by  physical  testing  against  the  theoretical  design  suitability  and, 
hence,  a  check  on  the  quality  of  workmanship  employed  in  the  construction  of 
the  pilot  production. 

Full  Scale  Engine  Test.  In  this  test,  the  entire  propeller  assembly  is 
driven  by  its  associated  aircraft  engine  under  normal  bay  conditions.  The 
test  requires  150  trouble-free  hours.  However,  the  test  may  be  run  inter¬ 
mittently,  with  maintenance  action  allowed.  Only  a  roughly  defined  "cata¬ 
strophic"  failure  requires  that  the  test  be  rerun.  Properly  instrumented, 
this  test  answers  the  following  questions: 

(1)  What  is  the  infant  mortality  rate  and  failure  type  (vital, 
critical,  subcritical)  under  normal  bay  conditions? 

(2)  How  does  the  system  respond  to  command  and  feedback 
signals  under  normal  bay  operating  conditions? 
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(3)  How  much  control  has  the  system  over  the  operation  of  the 
engine  ? 

(4)  Has  vibration  affected  the  operation  of  the  system? 

(5)  Is  the  system  easily  installed  and  maintained? 

(6)  Are  the  components  compatible? 

Environmental  Test.  The  environmental  test  ranges  from  40  to  50 
hours  in  length.  Temperature  and  pressure  (altitude)  are  cycled  in  accord¬ 
ance  with  MIL-E-5272A.  Information  is  obtained  pertinent  to  these 
questions : 

(1)  What  is  the  infant  mortality  rate  failure  pattern  and  failure 
type  (vital,  critical,  subcritical)  of  a  system  subjected  to 
temperature  and  pressure  cycling? 

(2)  Is  the  system  easily  installed  and  maintained? 

(3)  Are  the  components  compatible? 

(4)  How  is  the  endurance  capability  of  the  system  affected  by 
temperature  and  pressure  cycling? 

Functional  Test.  The  functional  test  subjects  the  system  to  overstress 
conditions.  The  system  functions  observed  at  the  high  stress  levels  are: 

(a)  Feathering  operation  (at  over  speed) 

(b)  Pitch  cycling  endurance 

(c)  Operating  torques  on  manual  levers  (at  various  levels  of 
overspeed) 

(d)  Tests  of  control  safety  provisions. 

The  information  gathered  is  relevant  to  these  questions: 

(1)  What  is  the  failure-rate  pattern  (infant  mortality)  and  type 
(vital,  critical,  subcritical)  of  a  system  subjected  to 
overstress  conditions? 

(2)  Is  the  system  easily  installed  and  maintained? 

(3)  Are  the  components  compatible? 
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(4)  How  is  the  endurance  of  the  system  affected  by  overstress 
conditions  ? 

(5)  How  does  the  system  respond  to  command  and  feedback  signals 
under  overstress  conditions? 

(6)  What  are  the  operational  limits  of  the  system?  (For  instance, 
what  is  the  maximum  over  stress  condition  under  which  the 
system  will  operate  within  tolerance?) 


Conclusions 


It  is  noted  that  duplication  of  information  occurs  in  these  tests.  This 
duplication  is  desirable  in  one  sense  and  undesirable  in  another. 

The  major  point  in  favor  of  duplication  of  information  under  various 
conditions  is  that  correlations  can  be  made  that  will  help  determine  the  effect 
of  a  particular  condition  on  a  specific  system  parameter.  For  instance,  a 
governor  assembly  might  function  perfectly  under  several  imposed  conditions, 
but  show  a  number  of  failures  when  the  system  is  subjected  to  pressure 
cycling.  In  such  a  case,  the  condition  that  caused  the  failures  could  be 
isolated. 

From  a  reliability  standpoint,  however,  duplication  of  information 
under  various  conditions  is  undesirable  because  the  hours  of  test  under 
these  conditions  cannot  be  combined  to  give  an  over -all  system  reliability 
figure.  This  reliability  viewpoint  will  be  discussed  in  detail  in  the  section 
devoted  to  the  reliability  aspects  of  the  qualification  testing  problem. 

A  tabular  summary  of  the  results  of  the  preceding  study  is  shown  in 
Figure  7. 

Basically,  the  qualification  test  subjects  the  propellers  to  three 
conditions:  (1)  ideal  ground  conditions,  (2)  temperature  and  pressure 
environment,  and  (3)  over  stress.  Under  the  assumption  of  a  true  exponential 
failure  rate,  this  is  equivalent  to  operating  a  system  for  A  hours  under  ideal 
conditions,  adding  Environment  I  (temperature  and  altitude)  and  operating  the 
system  for  B  additional  hours,  and  finally  adding  Environment  II  (overstress) 
and  operating  the  system  for  C  additional  hours.  Because  of  this  difference 
of  conditions,  A,  B,  and  C  cannot  be  added  together  and  considered  as  total 
operating  time.  However,  assurance  figures  based  on  these  three  conditions 
may  be  combined  to  give  an  assurance  figure  based  on  the  test  as  a  whole. 
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To  simplify  matters,  the  10-hour  whirl-rig  test  will  be  combined  with 
the  150-hour  full-scale  engine  test  in  what  we  have  called  ideal  ground  condi¬ 
tions.  The  qualification  test  breaks  down  then  as  follows: 

Ideal  ground  condition  160  hours 

Temperature  and  altitude  conditions  50  hours 

Over  stress  condition  500  hours 

Total  710  hours 

If  the  four  /stems  on  test  are  identical  and  an  exponential  failure  rate 
is  assumed,  the  qualification  testing  of  four  systems  is  equivalent  to  testing 
one  system  for  710  hours.  These  hours  are  divided  into  three  groups, 
corresponding  to  the  three  conditions  imposed. 

An  example  of  the  calculation  of  assurance  based  on  the  present  quali¬ 
fication  test  results  should  clarify  the  above  statements.  Assume  that  four 
propeller  systems  complete  the  tests  with  no  failures  observed.  This  is 
equivalent  to  one  unit  surviving  the  three  aforementioned  conditions  with  no 
observed  failures.  Now,  what  assurance  do  we  have  that  the  mean  time  to 
failure  of  a  typical  system  exceeds  the  desired  mean  time  to  failure  -  say 
50  hours  ? 

First,  the  ratio  of  duration  of  test  to  desired  mean  time  to  failure  is 

or  3.  2  for  the  normal  bay  condition.  Referring  to  Figure  8,  it  is  easily 

seen  that  the  level  of  assurance  corresponding  to  the  r  =  0  curve  is  95.  9  per 
cent.  This,  then,  is  the  assurance  figure  estimated  by  this  test. 

Next,  the  assurance  figures  for  the  50-  and  500-hour  tests  are  found 
from  Figure  8.  These  figures  are: 

50-hour  test:  63.  2  per  cent 
500-hour  test:  100  per  cent 

These  assurance  figures  may  then  be  multiplied  together  to  give  a  final 
figure  of  60.  6  per  cent  assurance  that  a  typical  control  system  will  go  at 
least  150  hours  (3  x  50  hours)  without  failure. 

If  one  or  more  failures  were  observed  during  the  test,  the  assurance 
figure  would  be  correspondingly  lower. 

Now,  let  us  suppose  for  a  moment  that  these  three  tests  can  be  com¬ 
bined.  This  would  be  possible  if  all  three  conditions  were  encountered  in 
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each  of  the  three  tests ,  or  if  the  individual  conditions  were  weighted  and 
arranged  in  such  a  way  that  the  complete  qualification  test  simulated  actual 
flight  conditions.  The  ratio  of  duration  of  test  to  desired  mean  time  to  fail- 
710 

ure  is  now  y^Q  =  4.  7  (assuming  a  desired  mean  time  to  failure  of  150  hours). 

If  no  failures  were  observed  during  the  test,  Figure  8  shows  that  the  assur¬ 
ance  of  true  mean  time  to  failure  exceeding  the  desired  mean  time  to  failure 
is  very  nearly  100  per  cent.  Perhaps  a  more  graphic  way  of  showing  the 
advantage  of  being  able  to  combine  the  three  tests  is  to  compute  what  desired 
mean  time  to  failure  may  be  chosen  for  the  confidence  level  found  previously 
(60.  6  per  cent)  when  the  test  hours  were  not  combined.  Figure  8  shows  that 
the  ratio  of  duration  of  test  to  desired  mean  time  to  failure  at  60.  6  per  cent 
for  no  observed  failures  is  approximately  0.92,  The  mean  time  to  failure 
for  710  hours  of  test  is  then  710  x  0.92  or  653.  2  hours,  as  compared  with 
150  hours  when  the  test  hours  cannot  be  combined. 

This  study  has  brought  to  light  two  important  facts. 

First,  if  the  qualification  tests  were  modified  so  that  the  data  obtained 
were  more  valuable  from  a  reliability  standpoint,  these  same  data  would  be 
less  valuable  from  a  specific  "cause  of  failure"  standpoint.  The  system  as  a 
whole  should  perhaps  be  tested  in  a  manner  that  would  yield  the  most  relia¬ 
bility  information  and  important  subassemblies  tested  separately  under  iso¬ 
lated  conditions  for  the  specific  cause-and-effect  information. 

Secondly,  it  seems  obvious  that  more  data  must  be  obtained  if  the 
desired  confidence  levels  are  to  be  predicted  or  estimated.  There  are  three 
courses  of  action  that  will  provide  this  increased  level  of  information: 

(1)  Increased  sample  size 

(2)  More  hours  of  test 

(3)  Accelerated  testing  to  simulate  increased  testing  time. 

A  combination  of  the  above  would  undoubtedly  prove  the  most  satis¬ 
factory  from  both  economical  and  technical  standpoints. 


Concepts  for  Revision  of  the  Testing  Program 


Simulated  Use  Tests  and  the  Necessity 
for  Test  Acceleration 


In  the  study  of  the  present  qualification  test  for  propeller-control  sys¬ 
tems,  several  facts  were  brought  out.  First,  the  duplication  of  information 
from  tests  under  differing  environmental  conditions  is  desirable  in 
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determining  cause-of-failure  information,  but  is  undesirable  for  the  purpose 
of  predicting  reliability,  Second,  more  complete  information  must  be  ob¬ 
tained  from  the  qualification  test  in  order  to  estimate  the  life  of  the  control 
system  to  the  desired  reliability  levels.  A  combination  of  more  testing  hours 
and  increased  sample  size  would  be  necessary  to  obtain  the  required  informa¬ 
tion.  A  possible  solution  to  these  problems  would  involve  testing  the  entire 
control  package  under  conditions  simulating  actual  flight  operation.  The 
desirable  cause-of-failure  and  time -to -failure  information  could  be  obtained 
by  testing  vital  components  and  subassemblies  separately  under  isolated  and 
accelerated  stress  conditions. 

The  study  of  the  present  qualification  test  has  pointed  out  that  combining 
test  hours  from  the  four  systems  on  test  allowed  much  greater  confidence  in 
the  reliability  estimate  than  treating  each  test  separately.  However,  the 
grouping  of  nonhomogeneous  test  data  is  fallacious.  In  order  to  pool  such 
data,  the  test  conditions  imposed  on  each  system  must  be  identical,  and  each 
system  tested  must  be  representative  of  the  final  production  model.  Even  if 
we  could  control  these  possible  variables,  obtaining  time -to -failure  informa¬ 
tion  from  a  simulated-use  system  test  would  be  extremely  impractical.  The 
stated  requirement  for  the  catastrophic  failure  rate  of  the  turboprop- control 
system  demands  greater  than  99  per  cent  probability  of  a  catastrophic  failure 
rate  within  1500  hours  of  less  than  10“^  per  flight  hour.  Assuming  that  no 
catastrophic  failures  are  observed  within  the  testing  period,  at  a  99  per  cent 
confidence  level  the  necessary  test  time  would  be  5  x  10^  hours. 

Even  by  pooling  data  from  a  large  sample  size,  system  testing  on  such 
a  large  scale  would  be  economically  out  of  the  question.  Similarly,  it  can  be 
calculated  that  1. 54  x  10^  hours  of  system  tests  would  be  necessary  to  be 
99  per  cent  sure  that  the  system  would  have  an  emergency-action  failure  rate 
within  1500  hours  of  less  than  3.  25  x  10“^  per  flight  hour.  Again,  the  cost 
of  this  amount  of  testing  on  a  system  level  would  be  prohibitive.  The  only 
solution  to  this  testing  problem  involves  some  form  of  accelerated  testing. 

A  possible  solution  lies  in  the  fact  that  the  causes  of  catastrophic  failures 
and/or  emergency- action  failures  can  be  isolated  and  assigned  to  a  relatively 
small  number  of  components.  These  components  may  be  of  such  a  nature 
that  tests  at  high  acceleration  rates,  using  large  sample  sizes,  might  be 
applicable. 

Twenty-five  hundred  hours  of  test  would  be  necessary  to  be  99  per  cent 
confident  that  the  system  would  have  a  maintenance -action  failure  rate  within 
1500  hours  of  less  than  0.  002  per  flight  hour.  This  finally  comes  within  the 
realm  of  practical  testing.  Besides,  separate  testing  of  components  would 
not  be  applicable  to  predicting  maintenance  failures  usually  caused  by  the 
failure  of  subcritical  components  that  make  up  the  majority  of  system  com¬ 
ponents.  For  this  reason,  a  test  of  the  entire  system  is  more  practical  than 
a  test  of  all  the  components.  The  test  module  for  such  a  system  test  should 
be  1500  hours.  This  would  assure  staying  in  the  operating  life  of  the  system 
where  the  exponential  failure  rate  applies  and  supplying  the  information 
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necessary  to  fulfill  a  reliability  requirement  that  50  per  cent  of  these  sys¬ 
tems  must  survive  1500  flight  hours  without  premature  removal.  Two  meth¬ 
ods  for  conducting  such  a  test  are: 

(1)  Subject  all  propellers  on  test  to  a  mixture  of  all  conditions 
expected  in  normal  flight  operations 

(2)  Subject  the  systems  on  test  to  isolated  conditions  arranged 
and  weighted  so  as  to  simulate  a  flight  cycle. 

The  second  method,  in  addition  to  providing  the  necessary  reliability  infor¬ 
mation,  would  allow  correlations  to  be  made  that  would  help  determine  which 
imposed  conditions  caused  particular  types  of  failures. 

Some  of  the  facets  of  the  system  testing  problem  that  should  be 
examined  are: 

(1)  What  conditions  should  be  imposed  on  the  system  and  what 
limits  should  be  placed  on  these  conditions? 

(2)  Is  it  desirable  to  attempt  to  accelerate  the  system  test? 

An  obvious  answer  to  the  first  part  of  question  one  is,  "those  conditions  that 
are  encountered  in  the  operational  environment".  Defining  this  operational 
environment,  however,  poses  a  problem.  An  aircraft  may  be  operated  in 
Alaska  or  in  Panama.  It  may  be  flown  daily  or  only  occasionally.  It  may  or 
may  not  be  flown  in  smooth  weather  the  majority  of  the  time,  depending  upon 
the  location  of  the  home  base.  Thus,  not  one,  but  many  possible  environ¬ 
ments  exist.  A  practical  laboratory  test,  however,  could  involve  only  one 
environmental  cycle.  Since  the  control  system  has  to  operate  satisfactorily 
at  any  location,  the  qualification  test  should  include  the  environmental 
extremes  -  for  instance,  the  high  temperature  of  Panama  and  the  low  temper¬ 
ature  of  Alaska.  This  line  of  reasoning  leads  to  two  conclusions: 

(1)  A  practical  test  cannot  be  devised  that  will  simulate  a  real 
operational  environment. 

(2)  The  most  logical  choices  for  the  test  limits  are  the  operating 
environment  extremes,  but  this  possibly  introduces  an  unknown 
acceleration  factor,  since  the  test  would  of  necessity  be  more 
stringent  than  any  one  actual  environment. 

The  term  "environment"  as  used  in  this  discussion  includes  any  condition  or 
influence,  natural  or  human,  that  affects  the  control  system.  Thus,  such 
factors  as  weather  condition,  overstress,  vibration,  and  maintenance  action 
are  considered  part  of  the  environment.  Ideally,  a  complete  system  test 
should  include  all  of  the  conditions  encountered  in  an  operating  environment. 
However  ,  such  a  test  conducted  in  the  laboratory  would  be  impractical. 
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The  second  question  pertains  to  the  advisability  of  accelerating  a  sys¬ 
tem  test.  System  deterioration  can  be  accelerated  by  increasing  the  stress 
imposed.  However,  it  would  be  extremely  difficult  to  determine  just  what 
acceleration  factor  had  been  introduced,  since  the  degree  of  acceleration 
would  be  different  for  each  component  and  subassembly  in  the  system,  A 
great  deal  of  operational  data  would  be  necessary  in  order  to  compute  accel¬ 
eration  factors,  and  this  volume  of  data  is  usually  not  available  on  a  prototype 
control  system  submitted  for  qualification  testing. 

Another  factor  to  be  considered  is  the  relationship  between  failures 
and  stress  level.  There  is  always  a  specific  cause  for  every  system  failure. 
If  the  mode  and  the  distribution  of  failures  remained  the  same  when  the  stress 
level  was  increased,  acceleration  might  be  feasible;  but  it  does  change.  This 
fact  is  most  easily  depicted  by  referring  to  the  most  commonly  used  S-N  plot 
for  fatigue -failure  data.  Points  signifying  failure  occurrence  for  a  given 
stress  level  are  plotted  in  a  rectangular -coordinate  system,  where  stress 
level  is  the  ordinate  and  the  number  of  stress  applications  is  the  abscissa. 

The  distribution  of  failures  can  be  roughly  approximated  by  two  straight  lines, 
as  shown  in  Figure  9.  These  two  segments  are  referred  to  as  the  "derating 
curve"  and  the  "infinite"  or  "near -infinite"  life  curve.  The  statistical  impli¬ 
cations  of  these  two  segments  are  totally  different.  The  derating  curve  is 
plotted  through  the  mean  of  the  distribution  of  failure  occurrences  at  various 
stress  levels,  whereas  the  infinite  life  curve  is  rather  poorly  defined  and  is 
constructed  through  observations  of  the  first  failure. 


FIGURE  9.  IDEALIZED  S-N  PLOT 

This  plot  basically  applies  only  to  components,  but  since  the  plot  of  a  sys¬ 
tem  is  a  composite  of  the  combined  S-N  plots  of  its  components,  the  plot 
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shown  is  valid  for  a  system  in  a  general  discussion  such  as  this.  Assume 
that  the  normal  operating  stress  occurs  at  point  A.  If  the  stress  is  increased 
to  point  B  in  an  attempt  to  accelerate  time,  the  operating  point  moves  up  onto 
the  derated  portion  of  the  curve.  On  this  part  of  the  curve,  the  assumption 
that  the  mode  of  failure  is  the  same  as  that  under  normal  stress  no  longer 
holds.  This  can  be  explained  by  the  fact  that,  although  a  normal  distribution 
of  failures  probably  occurs  at  both  stress  levels,  point  A  is  on  the  tail  of  this 
distribution,  whereas  point  B  is  somewhere  near  the  mean  of  a  normal  dis¬ 
tribution.  The  fact  that  at  stress  level  A  the  failures  of  interest  lie  at  the 
end  of  the  distribution  allows  the  assumption  of  an  exponential  failure  rate. 
This  assumption  is  not  valid  at  stress  level  B  and  cannot  be  called  a  true 
acceleration  of  time.  Why  not  accelerate  the  number  of  stress  applications, 
then?  This  is  possible  in  the  case  of,  say,  a  level  that  normally  is  activated 
a  finite  number  of  times  during  the  normal  operation  of  the  system.  With 
such  components  as  shafts,  however,  an  increase  in  the  stress  level  is 
experienced  as  the  shaft  is  rotated  at  an  accelerated  rate.  There  may  be  a 
solution  to  this  problem  without  having  to  use  component  testing,  but  it  would 
involve  unique  instrumentation  and  would  probably  be  economically 
impractical. 

From  a  consideration  of  these  two  problems,  it  appears  that  the  most 
practical  method  for  predicting  maintenance  failure  rates  would  involve  field 
tests.  Laboratory  tests  cannot  hope  to  simulate  the  multitude  of  environ¬ 
mental  conditions  that  will  be  encountered  in  actual  field  use.  Also,  any  form 
of  simulation  runs  the  risk  of  imposing  undue  stress  conditions  on  the  system, 
thereby  distorting  the  test  results.  This  distortion  would  not  be  a  problem  if 
we  had  some  means  for  determining  what  it  was.  However,  the  quantification 
of  this  distortion  factor  would  involve  the  collection  and  analysis  of  a  great 
quantity  of  fie  Id- ope  ration  and  laboratory  test  data. 


The  Problems  of  Accelerated  Testing 

As  previously  stated,  catastrophic  and  emergency-failure  rates  cannot 
be  determined  by  simulated-use  tests.  Since  the  minimum  required  test 
duration  is  10®  hours,  some  means  must  be  found  to  accelerate  time  in  order 
to  accomplish  the  desired  testing  in  a  practical  length  of  time. 

The  basic  assumption  in  the  formulation  of  accelerated  testing  tech¬ 
niques  is  the  analysis  of  the  relationship  between  applied  stress  and  the 
number  of  applications  of  that  stress.  These  two  factors  are  the  major  con¬ 
tributions  to  fatigue  failures,  and  it  is  the  fatigue  failure  that  is  the  most 
difficult  to  predict  with  any  degree  of  confidence.  Normal  attrition  or  wear 
can  be  studied  in  the  laboratory  by  radioactive  techniques  and  the  "wear 
curves"  extrapolated  to  predict  the  end  of  life  with  considerable  precision. 

Up  to  the  present  time,  the  study  of  the  S-N  relationship  has  been  used  only 
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as  a  theoretical  technique  to  aid  the  designer  in  the  fabrication  of  reliable 
equipment.  To  our  knowledge,  the  implications  of  this  relationship  for  the 
evaluation  of  the  reliability  of  hardware  has  never  been  considered. 


FIGURE  10.  S-N  PLOT 

Figure  10  indicates  the  relation  between  stress  applications,  S,  and  the 
number  of  cycles  of  application  of  the  stress  for  various  failure  percentiles. 
These  curves  are  considered  as  representing  three  regions:  (1)  the  derating 
region,  associated  with  a  relatively  small  number  of  applications  of  a 
relatively  large  stress,  (2)  the  infinite  life  region,  associated  with  a  large 
number  of  applications  of  a  small  stress,  and  (3)  an  intermediate  region,  or 
transition  region,  between  the  derating  and  infinite  life  regions.  In  the 
fatigue  failure  of  materials,  these  regions  generally  have  distinct  physical 
inte  rpr  etations . 

An  analysis  of  the  S-N  relationship  leads  to  the  following  conclusions: 

(1)  To  accelerate  the  life  properties  of  any  element  accurately  so 
that  the  results  of  the  accelerated  life  test  are  directly 
proportional  to  the  actual  life  of  the  element  under  normal 
operating  conditions,  the  stress  level  imposed  in  testing 
must  not  be  raised  above  the  maximum  stress  level  experienced 
under  normal  operating  conditions.  The  only  variable  that  can 
affect  acceleration  without  introducing  distortion  is  the 
frequency  of  application  of  applied  stress.  If  the  stress  level 
is  raised,  the  degree  of  distortion  imposed  on  the  test  results 
must  be  quantified  in  order  to  make  the  results  meaningful. 


WADC  TR  59-106 


57 


(2)  The  exact  nature  of  the  stresses  imposed  on  the  various 
components  must  be  analyzed  in  order  to  determine  just  how 
much  acceleration  may  be  introduced  before  the  stress  level 
begins  to  rise. 

(3)  The  approximation  of  the  S-N  distribution  by  a  pair  of  straight 
lines  is  extremely  rough.  Actually,  the  transition  from  the 
infinite  life  portion  of  the  "curve"  to  the  derated  portion  is  a 
gradual  one. 

(4)  If  the  stress  level  is  raised  by  the  introduction  of  a  large 
acceleration  factor,  there  is  no  real  justification  for  assuming 
that  the  added  stress  is  of  the  same  type  as  the  normal  stress. 

(5)  If  the  stress  level  is  raised  by  acceleration,  the  calculation 
of  an  acceleration  fa*  or  becomes  complicated  by  the  addition 
of  a  second  variable.  If  the  normal  operating  stress  is 
maintained,  the  acceleration  rate  is  merely  a  simple  time 
relation  that  is  easily  determined. 

(6)  In  Figure  11,  the  maximum  time  limit  for  the  accelerated 
test  module  occurs  at  t^,  where  the  constant-hazard- rate 
(exponential  failure  rate)  portion  of  the  curve  ends.  Now, 
modify  the  time  axis  by  the  ratio  fn/fQ>  where  f0  is  the  normal 
activation  frequency  of  a  component  and  fn  is  some  accelerated 
frequency.  Then  fn/f0  i*  the  acceleration  factor.  Assuming 
that  the  stress  level  is  not  affected  by  an  increase  in  frequency 
to,  say,  f,  the  curve  of  Z  versus  t(fn/fQ)  for  f  =  fj  would  be 
identical  to  the  curve  for  f  =  fQ.  Now  suppose  the  frequency  were 
increased  to  some  frequency  f^  that  does  cause  an  increase  in 
the  stress  level.  The  curve  will  now  be  altered  in  some  fashion; 
probably,  the  constant  hazard  rate  will  be  raised,  the  Gaussian 
pattern  changed,  and  shifted.  At  least,  some  noticeable 
change  would  be  expected.  Some  frequency  will  be  the  limiting 
activation  frequency.  At  frequencies  above  f^,,  the  curves  of  Z 
versus  t(fn/fQ)  begin  to  differ. 

The  preceding  statements  present  a  specific  framework  within  which 
the  reliability  of  components  and  systems  may  be  studied.  However,  strict 
adherence  to  S-N  theory  places  severe  restrictions  on  the  design  of  test  con¬ 
ditions  and  the  implementation  of  accelerated  tests.  In  order  to  design  a 
practical  accelerated  test,  the  fatigue  theory  must  be  preserved  in  essence, 
but  incorporated  into  some  more  general  approach  that  will  enable  a  relaxa¬ 
tion  of  the  requirement  for  absolute  adherence  to  actual  use  stress  conditions 
A  further  objection  to  strict  adoption  of  the  S-N  theory  of  failure  arises  from 
the  assumption  that  a  periodic  stress  is  the  sole  contribution  to  the  fatigue  of 
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the  components  materials.  Although  such  a  contention  may  prove  to  be 
correct  for  turbopropeller  control  systems,  it  may  be  expected  that  the 
reliability  of  some  systems  would  not  be  appropriately  treated  in  terms  of 
periodic  stresses.  In  particular,  nonperiodic  or  static  stresses  may  be  of 
more  importance  in  producing  failures  in  certain  systems  and  may  contribute 
greatly  to  the  generation  or  propagation  of  material  defects  involved  in 
fatigue  phenomena. 


FIGURE  11.  NORMAL  SYSTEM  FAILURE  PATTERN  (HAZARD 
RATE  VERSUS  TIME) 

Moreover,  the  very  existence  of  the  S-N  curve  suggests  that  fatigue 
phenomena  are  not  expressible  in  terms  of  material  properties.  For 
example,  the  objective  of  a  mathematical  formulation  of  fatigue  failures 
would  be  an  expression  having  the  form: 

p  r  f(S,N,Xp  ...  ,Xn), 

where  p  denotes  the  probability  of  failure,  S  denotes  applied  stress,  N  de¬ 
notes  the  number  of  stress  applications,  and  Xp.  .  .  ,  Xn  denote  material 
properties  such  as  tensile  strength,  hardness,  element  configuration,  etc. 
Because  it  is  common  practice  to  omit  the  material  properties,  one  is  led 
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to  suspect  that  the  material  properties  have  never  been  satisfactorily  re¬ 
lated  to  fatigue  failures.  Thus,  a  statistical  description  is  ail  that  remains 
in  the  usual  S-N  curve,  based  on 

P  =  f(S,N), 

where  the  curve  is  valid  only  for  the  particular  element  studied.  This  sug¬ 
gests  that  true  modeling  of  fatigue  failures  in  dissimilar  elements  is  not 
possible,  a  conclusion  that  is  also  substantiated  by  the  following  remark 
by  Langhaar^  *); 

"There  are  some  fields  in  which  dimensional  analysis  has  had 
little  application,  because  the  existing  knowledge  in  these  fields 
is  inadequate  to  indicate  the  significant  variables.  For  example, 
the  endurance  limits  of  members  that  are  subjected  to  alternating 
stresses  have  not  been  correlated  with  other  measurable  properties 
of  materials.  Consequently,  dimensional  analysis  (and  the 
associated  theory  of  models)  cannot  yet  be  brought  to  bear  on 
questions  of  fatigue  of  materials.  " 

These  remarks  suggest  that  if,  in  fact,  reliability  is  describable  as  a 
fatigue  problem,  and  if  the  material  properties  are  not  strongly  related  to 
fatigue  failures,  then  the  statistical  description  typified  by  the  S-N  curve 
may  be  the  only  practical  approach  to  the  acceleration  problem. 

To  maintain  its  validity,  the  S-N  relationship  requires  that  applied 
stress  be  described  in  terms  of  environmental  forces  or  conditions.  In  the 
more  generalized  formulation,  the  probability  of  failure  thus  has  the  form: 

p  =  f(S*,N), 


where  S*  =  g(Y j ,  Yn) 

and  g(Yp...  i  Yn)  denotes  some  function  of  environmental  conditions  and  S* 
serves  as  a  measure  of  the  "severity"  of  the  generalized  stress.  In  a 
similar  manner,  the  meaning  of  the  number  of  stress  applications  becomes 
more  general  when  the  generalized  stress  is  introduced.  Basically,  the 
number  of  generalized  stress  applications  is  a  measure  of  time.  Thus,  the 
formulation  of  the  failure  probability  may  be  written  as 

p  =  f(S*,  N*), 

where  S  =  g(Y  i , . .  .  ,  Yn) 

and  N*  =  h(t). 


(1)  Langhaar,  H,  L,t  Dimensional  Analysis  and  Theory  of  Models,  John  Wiley  &  Sons,  Inc,,  1951,  p  15, 
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The  S-N  curves  are  thus  replaced  by  S*-N*  curves ,  which  may  exhibit 
properties  quite  similar  to  those  of  the  S-N  curves.  However,  interpreta¬ 
tion  and  meaning  of  the  generalized  stress  and  time  function  may  be  more 
appropriate  to  the  reliability  problem. 

The  use  of  model  theory  appears  to  be  a  practical  solution  to  resolv¬ 
ing  these  objections.  By  proper  applications  of  accepted  modeling  tech¬ 
niques,  a  suitable  scaling  factor  may  be  introduced  such  that  distortion 
appearing  in  accelerated  test  results  may  be  quantified.  In  addition,  gener¬ 
alized  stresses  may  be  considered  and  material  properties  taken  into 
account. 


WADC  TR  59-106 


61 


-  *  «**'*.»<«**»  - 


APPENDIX  C 

ACCELERATED  TESTING  AS  A  PROBLEM  OF  MODELING 


WADC  TR  59-106 


APPENDIX  C 

ACCELERATED  TESTING  AS  A  PROBLEM  OF  MODELING 

Table  of  Contents 

Pag® 

INTRODUCTION .  63 

BASIC  CONCEPTS  IN  THE  THEORY  OF  MODELS .  64 

Dimensional  Analysis .  64 

The  Formulation  of  Reliability  Functions .  65 

The  Theory  of  Models .  66 

Accelerated  Testing .  69 

Concept  of  Generalized  Stress .  71 

Concept  of  Generalized  Time .  72 

The  Problem  of  Scale  Factors .  72 

MODEL-PROTOTYPE  RELATIONS  SUITABLE 
FOR  ACCELERATED  TESTING .  73 

Prediction  of  Catastrophic  Failures  Using  Model  Theory  .  78 

The  Use  of  the  Exponential  Distribution  of  Failure  Times 
in  the  Model -Theoretic  Approach  to  Reliability  ....  82 

Estimation  of  the  Probability  of  Catastrophic  Failures 
for  Various  Operating  Time  Periods .  84 

A  GENERAL  MODEL-PROTOTYPE  RELATION  FOR 
ACCELERATED  TESTING .  86 

Decomposition  of  the  Generalized  Stress .  86 

The  Stress -Range  Diagram .  87 

Complications  Involved  in  Time  Dependence .  91 

Alternative  Representation  of  Stress  Decomposition  ...  92 

Interpretation  of  Trajectory  on  Stress -Range  Diagram  .  .  94 

Difficulties  in  Interpretation  of  Trajectory  Diagram  ...  97 

Use  of  Practical  Bounds  to  Determine  Limits 
on  Trajectory  Diagrams .  98 

CONCLUSIONS .  100 

References .  101 


WADC  TR  59-106 


APPENDIX  C 
(Continued) 


List  of  Figures 

Page 

Figure  12.  Estimated  Per  Cent  of  Future  Failure  Times 
Expected  to  be  Less  than  the  Smallest 

Observed  Failure  Time .  80 

Figure  13.  Stress-Range  Diagram  Used  in  Metal -Fatigue  Studies.  88 

Figure  14.  Stress-Range  Diagram  With  Failure  Percentiles  .  .  88 

Figure  15.  Dimensionless  Form  of  Stress-Range  Diagram  .  .  90 

Figure  16.  Hypothetical  Sketch  of  the  Periodic  Proportion  of 

Total  Stress  as  a  Function  of  Time .  90 

Figure  17.  Hypothetical  Sketch  of  Intrinsic  Generalized 

Periodic  Stress  as  a  Function  of  Time .  93 

Figure  18.  Time  Trajectory  of  a  System  Plotted  on  a 

Generalized  Stress -Range  Diagram .  93 

Figure  19.  Hypothetical  Plots  of  System  Stresses  as  a 

Function  of  Time .  95 

Figure  20.  Hypothetical  Bounds  on  System  Stresses  as  a 

Function  of  Time .  95 

Figure  21.  Bounds  for  Time  Trajectories  of  a  System 

With  Stresses  Shown  in  Figure  20 .  99 


WADC  TR  59-106 


APPENDIX  C 


ACCELERATED  TESTING  AS  A  PROBLEM  OF  MODELING 


INTRODUCTION 


The  prediction  of  catastrophic  failures  of  a  highly  reliable  system  is 
often  unconvincing  when  made  without  benefit  of  actual  data.  Moreover, 
because  excessively  long  time  periods  are  required  to  obtain  a  single  cata¬ 
strophic  failure,  the  reliability  of  such  a  system  is  often  beyond  direct  ex¬ 
perimental  inquiry. 

In  this  case,  a  turboprop  control  system  is  required  to  have  a  mal¬ 
function  rate  with  catastrophic  consequences  of  less  than  1  in  10  million 
flying  hours.  The  experimental  demonstration  of  the  fulfillment  of  such  a 
requirement  with  a  newly  produced  turboprop  control  system  is  extremely 
difficult.  Neither  the  manufacturer  nor  the  purchaser  of  such  highly  re¬ 
liable  equipment  can  afford  the  time  required  to  amass  the  actual  experi¬ 
ence  that  will  make  the  reliability  computations  valid.  The  problem  be¬ 
comes  even  more  pressing  when  the  purchaser  refuses  the  equipment  unless 
the  required  reliability  is  first  established  by  the  manufacturer. 

These  problems  indicate  that  suitable  methods  are  needed  for  the  pre¬ 
diction  of  the  reliability  of  highly  reliable  systems.  In  addition  to  experi¬ 
mental  and  theoretical  validity,  these  methods  should  yield  reliability  pre¬ 
dictions  that  are  more  firmly  established  than  calculations  made  without  the 
benefit  of  actual  data.  Such  methods  should  also  yield  reliability  predic¬ 
tions  within  reasonably  short  time  periods  for  systems  that  are  highly  re¬ 
liable.  It  is  the  purpose  of  the  following  development  to  indicate  that  the 
theory  of  models  may  sometimes  furnish  methods  and  criteria  suitable  for 
the  rapid  generation  of  experimental  data  that  may  be  used  to  predict  the 
probability  of  a  catastrophic  failure  of  a  highly  reliable  system.  Reliability 
prediction  based  on  models  represents  a  compromise  between  unconvincing 
reliability  calculations  based  on  paperwork  estimates  and  calculations  based 
on  actual  operational  experience. 

The  importance  of  modeling  in  engineering  is  well  known.  In  many 
instances  of  advanced  technology  the  construction  of  a  prototype  is  never 
attempted  until  the  performance  characteristics  of  models  are  determined. 
Models  of  airframes,  ship  hulls,  and  dams  are  sometimes  geometrically 
similar  to  their  prototypes,  so  that  the  model  appears  to  be  uniformly  re¬ 
duced  or  expanded  in  size.  In  flow  of  fluids,  geometrical  similarity  is 
often  exchanged  for  dynamic  similarity,  such  that  the  observed  forces  in 
the  model  are  directly  proportional  to  corresponding  forces  in  the  proto¬ 
type.  In  some  instances  no  direct  dimensional  ratio  need  exist  between 
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model  and  prototype,  as  evidenced  by  the  use  of  analog  computers  to  simu¬ 
late  electronically  the  characteristics  of  nonelectronic  systems.  Many 
examples  of  practical  applications  of  modeling  theory  have  been  given  by 
LanghaarO),  Birkhoff(2),  and  other s(3> 4) # 

In  most  applications  of  modeling,  the  physical  performance  charac¬ 
teristics  of  the  prototype  are  predicted  from  data  obtained  from  experi¬ 
mental  studies  of  the  corresponding  characteristics  of  the  model.  Such 
characteristics  usually  consist  of  drag,  mass  flow,  temperature,  etc.  To 
a  large  extent  the  only  novel  feature  of  the  present  development  is  the 
assertion  that  the  same  general  method  of  modeling  is  also  valid  for  the 
prediction  of  prototype  reliability  when  using  the  observed  reliability  as¬ 
sociated  with  a  model. 

The  use  of  models  to  obtain  data  for  the  prediction  of  the  reliability  of 
the  prototype  may  also  raise  difficult  problems.  Some  of  the  assumptions, 
criteria,  advantages,  and  difficulties  associated  with  a  model -theoretic 
approach  to  reliability  prediction  are  examined  in  this  study. 


BASIC  CONCEPTS  IN  THE  THEORY  OF  MODELS 


Dimensional  Analysis 

The  theory  of  modeling  rests  on  the  principle  of  dimensional  analysis, 
which,  in  turn,  rests  on  certain  assumptions  regarding  the  mathematical 
formulations  of  physical  relations.  These  assumptions  have  been  sum¬ 
marized  in  mathematical  form  by  Birkhoff.  (2)  In  descriptive  terms,  it  is 
assumed  (1)  that  all  physical  quantities  can  be  measured  in  terms  of  appro¬ 
priate  combinations  of  fundamental  units,  such  as  lb/in.  2,  ft/sec^,  (2)  that 
the  magnitudes  of  physical  quantities  measured  in  terms  of  one  set  of  units 
may  be  re -expressed  in  terms  of  a  new  set  of  units  by  the  familiar  process 
of  "changing  units",  (3)  that  a  physical  equation  expresses  one  "dependent" 
variable  as  a  function  of  several  "independent"  variables,  and  (4)  that  the 
validity  of  such  a  function  does  not  depend  on  the  particular  set  of  funda¬ 
mental  units  chosen.  Although  these  assumptions  are  generally  valid  for 
laws  of  physics  and  mechanics,  the  philosophical  implications  and  interpre¬ 
tations  have  been  in  dispute  since  the  time  of  Fourier(S)  when  this  method 
was  first  formulated. 

As  a  rigorously  deduced  consequence  of  the  assumptions  associated 
with  dimensional  analysis,  Buckingham^)  proved  the  so-called  7T-theorem. 
The  symbol  7T  refers  to  "products"  of  the  original  variables  used  to  describe 
the  performance  of  a  physical  system.  In  descriptive  terms,  Buckingham 
proved  that  the  dependent  and  independent  variables  in  a  mathematical  func¬ 
tion  involving  physical  variables  can  be  replaced  by  appropriate  products 
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and  ratios  of  the  original  variables.  The  new  variables  have  the  property 
that  their  magnitudes  are  independent  of  the  system  of  units  used,  and, 
consequently,  are  said  to  be  Hdimensionlessn.  Familiar  examples  of  such 
dimensionless  quantities  are  specific  gravities  of  liquids,  radian  measures 
for  angles,  Reynolds  number  in  fluid  flow,  Mach  number,  etc.  In  addition 
to  the  fact  that  the  reformulation  of  a  physical  law  in  terms  of  dimensionless 
variables  usually  reduces  the  number  of  variables  involved,  it  is  particu¬ 
larly  important  that  Buckingham's  7r-theorem  places  a  condition  on  the  form 
of  the  variables  involved  in  a  function,  even  though  the  form  of  the  function 
may  not  be  known. 

In  view  of  the  above  results,  a  procedure  based  on  dimensional  analy¬ 
sis  for  determining  an  unknown  functional  relation  involving  physical  vari¬ 
ables  is  usually  given  as  follows:  (1)  make  a  list  of  the  relevant  variables, 
together  with  their  associated  dimensions  in  any  consistent  system  of  units, 
(2)  combine  these  variables  in  products  and  ratios  to  form  a  complete  set  of 
independent  dimensionless  parameters,  and  (3)  determine  the  unknown  func¬ 
tion  by  experimentally  varying  the  values  of  the  independent  dimensionless 
parameters  and  measuring  the  value  of  the  associated  dependent  dimension¬ 
less  parameter.  The  appropriateness  of  this  procedure  for  the  determina¬ 
tion  of  functions  giving  failure  probabilities  is  examined  in  the  next  section. 


The  Formulation  of  Reliability  Functions 

The  general  problem  of  predicting  the  reliability  of  a  physical  system 
has  many  features  that  suggest  the  appropriateness  of  the  techniques  of 
dimensional  analysis.  For  a  particular  system,  it  is  usually  (tacitly)  as¬ 
sumed  that  the  probability  of  failure  of  the  system  is  expressible  as  some 
(unknown)  function  of  relevant  variables.  For  convenience,  such  a  function 
is  called  a  reliability  function.  For  an  electronic  system,  for  example,  it 
may  be  supposed  that  the  probability  of  failure  in  time  t,  say  p(t),  is  mathe¬ 
matically  expressible  as  a  function  of  operating  voltage  V,  relative  humid¬ 
ity  H,  operating  temperature  0 ,  and  operating  hours  T;  so  that  p(t)  = 
f(Y,  H,  8,  T),  where  f  denotes  a  reliability  function  whose  form  is  unknown. 
It  is  arumed  that  such  a  function  exists,  and  that  the  form  of  the  function 
does  not  depend  on  whether  the  operating  voltage  is  measured  in  volts  or 
millivolts,  whether  operating  time  is  measured  in  hours  or  years,  etc. 
(fourth  assumption  under  "Dimensional  Analysis"). 

The  difficulties  associated  with  these  assumptions  are  apparent.  The 
effects  of  environmental  conditions  may  be  more  relevant  to  producing  a 
failure  than  the  internal  physical  properties  of  the  system.  Consequently, 
the  physical  system  considered  must  include  the  environment,  the  operator, 
maintenance  schedules,  and  whatever  else  is  believed  to  be  relevant  to  the 
prediction  of  reliability.  When  formulated  in  such  broad  terms,  it  is  clear 
that  enormous  difficulties  are  involved  in  choosing  a  set  of  relevant  vari¬ 
ables.  An  appropriate  set  of  variables  usually  involves  those  variables 
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associated  with  the  internal  processes  of  the  system,  the  external  processes 
in  the  environment,  and  the  interaction  between  the  system  and  its 
environment. 

In  a  particular  problem  it  is  usually  not  possible  to  assert  that  (1)  all 
of  the  variables  included  in  the  functional  form  are  relevant  and  (2)  all  of 
the  relevant  variables  are  included.  Either  error  may  have  serious  conse¬ 
quences.  If  some  particularly  relevant  variable  is  omitted,  the  mathemati¬ 
cal  formulation  may  be  invalid.  If  irrelevant  variables  are  included,  the 
"noise"  caused  b/  their  presence  may  mask  the  actual  significance  of  the 
relevant  variables.  However,  there  is  nothing  involved  in  this  formulation 
that  is  peculiar  to  the  problem  of  determining  a  reliability  function.  The 
same  problem  of  choosing  relevant  variables  also  exists  in  the  physical 
sciences  in  attempting  to  describe  physical  processes  in  mathematical 
terms.  Whereas  physical  processes  are  ordinarily  described  in  terms  of 
internal  system  variables,  the  reliability  process  must  generally  be  de¬ 
scribed  in  terms  of  both  internal  and  external  variables,  and,  in  some  in¬ 
stances,  the  external,  or  environmental,  variables  may  be  far  more  im¬ 
portant  for  the  prediction  of  reliability. 

If  it  is  asserted  that  no  relevant  set  of  variables  exists,  then  the 
mathematical  formulation  of  a  reliability  function  is  not  possible.  In  a  par¬ 
ticular  context,  this  assertion  is  by  no  means  logically  invalid.  On  the 
other  hand,  if  it  is  assumed  that  the  probability  of  failure  can  be  predicted 
quantitatively,  it  appears  that  one  must  simultaneously  assume  the  exist¬ 
ence  of  a  set  of  relevant  variables  and  the  existence  of  the  associated  func¬ 
tion.  Consequently,  the  assumptions  usually  involved  in  dimensional  analy¬ 
sis  must  also  be  assumed  to  hold  together  with  the  assertion  of  Buckingham1  s 
7T -theorem.  These  arguments  thus  lead  to  the  following  conclusion:  If  the 
probability  of  failure  of  a  given  physical  system  can  be  mathematically 
formulated,  then  the  predicting  function  is  expressible  in  terms  of  dimen¬ 
sionless  power  products  of  the  relevant  variables.  The  procedure  for  ob¬ 
taining  a  mathematical  formulation  is  then  identical  to  that  based  on  dimen¬ 
sional  analysis  given  in  the  preceding  section. 


The  Theory  of  Models 

The  assumptions  of  dimensional  analysis  lead  to  Buckingham's 
TT-theorem,  which,  in  turn,  yields  a  quantitative  basis  for  the  theory  of 
models.  To  show  this,  suppose  it  is  desired  to  predict  the  value  of  a  par¬ 
ticular  variable,  say  Q0,  associated  with  the  prototype  system  using  ex¬ 
perimental  data  obtained  with  a  model  system.  The  relevant  variables  for 
the  prototype  system  are  listed,  together  with  their  dimensions,  in  some 
consistent  set  of  units.  These  variables  are  then  combined  to  form  dimen¬ 
sionless  parameters,  tt0,  tti,...,  7Tn,  where  7T0  is  a  dimensionless  combi¬ 
nation  of  variables  that  involves  Q0.  The  formal  relation  among  these 
dimensionless  variables  may  then  be  written  as  follows: 
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7t0  =  ^^1  *  •  •  •  *  1Tn)’ 

where  the  function  f  is  unknown.  A  model  is  then  constructed  that  involves 
a  corresponding  set  of  dimensionless  parameters  7Tq,  7t\,.  .  .  ,  71^,  and  a 
formal  relation  among  them: 

no  =  (nl>  •  •  •  > 

If  the  model  is  so  constructed  that  =  ^\9 . . .  $  as  7rn,  and  if  it  is  assumed 
that  the  functional  form  of  f1  is  identical  to  that  of  f ,  then  it  follows  that 
*0  =  7T q,  and  this  equation  may  be  easily  solved  for  the  value  of  Q0  for  the 
prototype.  Thus,  the  basic  idea  involved  in  a  mo  del -prototype  relation  may 
be  briefly  described  as  follows:  The  corresponding  independent  dimension¬ 
less  parameters  of  the  model  and  prototype  are  made  numerically  equal. 
Then,  under  the  assumption  of  identical  functional  forms  among  these  inde¬ 
pendent  variables,  the  corresponding  dependent  dimensional  parameters 
must  also  be  equal.  From  the  equality  of  the  corresponding  dependent  vari¬ 
ables,  predictions  of  prototype  performance  can  be  made  using  the  observed 
performance  characteristics  of  the  model. 

To  illustrate  the  preceding  results  and  to  introduce  further  terms 
associated  with  this  model-theoretic  approach  to  reliability,  it  is  convenient 
to  consider  the  familiar  assumption  of  an  exponential  distribution  of  failure 
times.  In  its  simplest  form,  the  assumption  states  that  the  probability 
density  function  p(t)  for  the  failure  time  of  a  given  system  is  given  by: 

P(t)  =  t>0, 

where  the  constant  t  denotes  the  mean  life  of  the  system.  It  is  apparent 
that,  other  than  elapsed  time,  none  of  the  physical  properties  of  the  system 
are  assumed  to  be  relevant  to  the  prediction  of  failure.  Note  that  (t/r)  is  a 
dimensionless  parameter  so  that,  provided  t  and  r  are  measured  in  the  same 
time  units,  it  makes  no  difference  whether  seconds,  hours,  or  days  are 
adopted  as  units  of  time.  Moreover,  the  "element  of  probability",  p(t)dt, 
which  gives  the  probability  of  failure  of  the  system  in  the  time  interval 
(t,  t  +  dt)  may  be  written  as: 

p(t)dt  =  e “t/T  d(t/r), 

where  both  (t/r)  and  the  differential,  d(t/r),  are  dimensionless.  When 
written  in  this  form,  the  exponential  failure  assumption  conforms  with  the 
conclusion  derived  earlier  that  any  mathematical  formulation  of  the  prob¬ 
ability  of  failure  of  a  given  physical  system  is  expressible  in  terms  of 
dimensionless  ratios  and  products  of  the  relevant  variables.  It  is  easily 
shown  that  other  commonly  used  distributions,  such  as  the  Normal  distribu¬ 
tion  and  the  Poisson  distribution,  also  satisfy  the  dimensionless 
requirement. 
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Under  the  assumption  of  an  exponential  distribution  of  failure  times 
for  the  prototype,  the  theory  of  models  shows  that  any  other  system  that 
also  has  an  exponential  failure  distribution  may  serve  as  a  model  for  the 
prototype  provided  the  corresponding  dimensionless  ratio  of  the  model  and 
prototype  are  made  numerically  equal.  In  this  example,  a  model  may  be 
chosen  such  that: 


t*  /r’  =  t/T, 

where  the  primed  and  unprimed  symbols  refer  to  the  model  and  prototype, 
respectively.  This  equation  shows  that  a  model  having  a  mean  time  to  fail¬ 
ure  that  is  smaller  than  that  of  the  prototype  will  also  have  smaller  failure 
times,  and  also  shows  that  the  prototype  time  is  related  to  the  model  time 
as  follows: 

t  =  (£-)  f . 


It  follows,  for  example,  that,  if  the  ratio  of  prototype  mean  time  to  failure 
to  model  mean  time  to  failure  is  100,  then  1  hour  of  model  operation  is 
equivalent  to  100  hours  of  prototype  operation.  Consequently,  the  observed 
failure  probabilities  in  model  operation  during  time  periods  of  1  hour  are 
numerically  equal  to  the  predicted  failure  probabilities  for  the  prototype  for 
time  periods  of  100  hours. 

In  terminology  usually  associated  with  the  theory  of  models,  the  con¬ 
stants  r  and  r1  are  called  "characteristic  times",  and  the  ratio  (t/t1)  is 
called  a  "time  scale  factor".  The  ratio  (t/r)  may  be  regarded  as  an 
"intrinsic  time";  it  measures  in  dimensionless  terms  the  operating  time  of 
the  prototype  in  units  of  the  characteristic  time  of  the  prototype.  More 
generally,  the  variables  associated  with  a  prototype  system  are  usually  ex¬ 
amined  to  determine  whether  there  exist  various  characteristic  measures 
that,  when  used  as  units  of  measure,  will  allow  all  of  the  variables  of  the 
system  to  be  expressed  as  intrinsic  variables.  Such  intrinsic  variables  are 
always  dimensionless,  and  thus  suitable  for  modeling  applications. 

As  in  the  above  example,  each  equality  between  corresponding  dimen¬ 
sionless  parameters  of  the  model  and  the  prototype  yields*  a  scale  factor. 
Thus,  a  model  may  have  various  scale  factors,  one  for  time,  one  for  length 
etc.  ,  each  of  which  serves  to  relate  the  model  to  the  prototype.  In  practice 
the  model  characteristics  are  usually  selected  to  yield  scale  factors  of  de¬ 
sirable  magnitudes. 

In  many  applications  of  model  theory  it  is  not  possible  to  make  the 
dimensionless  parameters  of  the  model  exactly  equal  to  the  corresponding 
dimensionless  parameters  of  the  prototype.  The  resulting  disagreement 
between  the  model  and  prototype  is  usually  called  a  distortion,  and  empiri¬ 
cal  methods  are  required  to  relate  the  performance  of  the  model  to  that  of 
the  prototype.  Generally,  several  models  are  found  to  be  necessary  for 
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both  the  dimensionless  parameters  and  the  functions  that  relate  them. 
There  is  no  limit  to  the  type  or  magnitude  of  the  correction  that  may  be  in¬ 
troduced,  provided  the  prototype  performance  can  be  adequately  and  re- 
producibly  predicted  on  the  basis  of  the  performance  of  the  model.  How¬ 
ever,  in  such  applications,  a  gradual  and  painstaking  development  of 
appropriate  models  is  usually  required. 


Accelerated  Testing 

In  order  to  obtain  reliability  predictions  based  on  experimental  data, 
it  is  usually  necessary  to  obtain  failures,  and  for  highly  reliable  systems 
the  time  required  to  obtain  failures  is  excessive.  Under  these  conditions, 
it  is  sometimes  suggested  that  the  system  be  operated  under  "severe"  con¬ 
ditions,  at  higher  stresses,  higher  temperatures,  etc.  ,  in  order  to  produce 
failures  in  a  reasonably  short  period  of  time.  Such  "accelerated"  testing 
generally  causes  the  system  to  fail  in  shorter  time  periods  than  under  nor¬ 
mal  use.  However,  before  such  an  approach  can  be  adopted,  it  must  be 
asked:  What  criteria  can  be  used  to  relate  the  failure  patterns  observed  in 
accelerated  tests  to  the  predicted  failure  patterns  under  normal  use?  It  is 
shown  below,  when  certain  requirements  are  met,  that  model  theory  can 
furnish  the  desired  criteria. 

The  general  methods  that  permit  the  mo  del -prototype  relation  to  be 
described  for  systems  of  different  types  will  also  be  valid  for  systems  of 
the  same  type.  Although  trivial,  this  observation  permits  the  application 
of  the  principles  of  modeling  to  two  identical  systems,  one  of  which  under¬ 
goes  accelerated  testing  (the  model),  in  order  to  predict  the  reliability  of 
the  same  type  of  system  operated  in  normal  use  (the  prototype). 

Underlying  the  concept  of  accelerated  testing  is  the  assertion  that  the 
probability  of  failure  is  a  function  of  "stress"  and  time.  As  noted  earlier, 
the  reliability  of  a  system  generally  depends  on  both  internal  variables  and 
external,  or  environmental,  variables.  Consequently,  the  probability  of 
failure  of  the  prototype  system  may  be  written  as : 

P  =f(S,T), 

where 

S  =  g(71---»7n)> 

and  g(y^, .  . . ,  7n)  denotes  some  function  of  environmental  and  internal  con¬ 
ditions.  Thus,  the  "generalized"  stress,  S,  serves  as  a  measure  of  the 
"severity"  of  the  operating  conditions  over  a  corresponding  period  of 
"generalized"  time,  T.  More  detailed  consideration  is  given  to  the  con¬ 
cepts  of  generalized  stress  and  time  in  a  later  section. 
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From  Buckingham's  TT-theorem,  it  follows  that  the  above  probability 
may  be  expressed  in  terms  of  a  dimensionless  stress  parameter,  a,  and  a 
dimensionless  time  parameter,  r,  to  yield: 

P  =f(a,T).  (14) 

For  the  model,  the  probability  of  failure  is  written  as: 

P*  -WfT'  ),  (15) 

where  the  model  is  operated  with: 


a'  =a  (16) 

and 

T 1  =  T  (17) 

and  a  time -scale  factor  that  makes  1  model  hour  equal  to  a  sufficiently  large 
number  of  prototype  hours.  Then,  under  the  assumption  that  the  functional 
form  of  f'  is  the  same  as  that  for  f,  so  that: 

f-f%  (18) 

it  follows  that: 

P  =  P1  •  (19) 

Thus,  the  probability  of  failure  for  the  prototype  is  equal  to  the  observed 
probability  of  failure  for  the  model  in  a  prototype  time  interval  obtained 
from  the  model  time  interval  by  using  the  time -scale  factor  obtained  from 
the  equation  r  =  T\  The  assumptions  of  Equations  (14),  (15),  and  (18), 
together  with  conditions  of  Equations  (16)  and  (17),  are  sufficient  to  obtain 
Equation  (19),  which,  in  turn,  relates  the  probability  of  failure  obtained 
from  accelerated  test  data  to  the  probability  of  failure  for  the  system  under 
normal  use  by  means  of  the  time -scale  factor. 

Although  this  development  shows  that  model  theory  yields  a  suitable 
framework  for  the  description  of  accelerated  testing,  the  argument  is  quite 
general.  To  be  of  practical  significance,  the  generalities  involved  in  the 
concepts  of  generalized  stress  and  generalized  time  and  the  manner  in  which 
stress  and  time  are  rendered  nondimens ional  must  be  considered.  The  fol¬ 
lowing  sections  contain  more  detailed  discussions  of  these  matters.  After 
these  discussions,  the  example  of  accelerated  testing  is  reconsidered  at  a 
more  practical  level. 
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Concept  of  Generalized  Stress 

A  generalized  stress  may  include  mechanical  forces,  electrical 
stresses,  thermal  stresses,  effects  due  to  extremes  of  humidity,  frequency 
of  system  operation,  and  stresses  due  to  periods  of  storage.  In  broad 
terms,  the  generalized  stress  may  be  considered  to  be  the  net  effect  on  the 
system  of  the  internal  and  external  environment  at  any  given  time. 

Some  of  the  environmental  stresses  may  be  regarded  as  analogous  to 
the  "stress  application"  associated  with  studies  of  metal  fatigue  failures. 
These  stresses  include  frequency  of  operation,  rotation  of  shafts,  periodic 
electrical  impulses,  etc.  More  generally,  those  stresses  that  are  periodic 
in  time  may  be  identified  with  the  stress  application  of  metal  fatigue  studies. 
The  various  periods  need  not  be  equal  nor  commensurate.  Moreover,  in 
some  cases  it  may  be  possible  to  "superimpose"  the  various  periodic  phe¬ 
nomena  to  obtain  an  over-all  characterization  of  the  periodic  stresses  in¬ 
volved  in  the  system. 

In  addition  to  the  periodic  stresses,  there  may  also  be  nonperiodic 
stresses.  These  include  permanent  stresses,  such  as  progressive  chemi¬ 
cal  changes,  corrosion,  static  loading,  etc. ,  and  are  associated  with 
gradual  wear  of  mechanical  parts,  gradual  shifting  of  electrical  character¬ 
istics,  etc.  These  nonperiodic  stresses  form  a  continuous  background  on 
which  the  periodic  stresses  are  imposed. 

These  considerations  lead  to  the  following  decomposition  of  the  en¬ 
vironmental  stresses.  The  environmental  stresses  are  regarded  as  com¬ 
posed  of  periodic  stresses  superimposed  on  a  background  of  nonperiodic 
stresses.  The  over -all  combination  of  these  stresses  constitutes  the  gen¬ 
eralized  stress,  S.  A  practical  problem  exists  in  attempting  to  obtain  a 
quantitative  measure  that  reflects  the  magnitude  of  the  over-all  generalized 
stress. 

It  should  be  noted  that  a  third  component  of  the  environmental  stress 
that  is  not  considered  is  the  "impulsive"  stress,  that  is,  a  stress  induced  by 
an  isolated  incident  in  time.  Such  incidents  as  a  brief  mechanical  over- 
stress,  or  an  accidental  jolt,  for  example,  may  create  conditions  that  are 
important  components  of  the  environmental  stress.  However,  unless  such 
stresses  occur  with  sufficient  frequency  to  define  a  statistical  distribution, 
it  does  not  appear  possible  to  account  for  these  stresses  by  a  model- 
prototype  relation, 

A  characteristic  stress  associated  with  periodic  stresses  may  be  de¬ 
fined  in  any  of  various  ways.  The  maximum  stress  amplitude  and  the  root- 
mean- square  amplitude  are  typical  measures  suitable  for  a  characteristic 
stress.  For  nonperiodic  stresses,  the  adoption  of  a  characteristic  stress 
is  more  difficult,  and  an  arbitrary  definition  is  usually  required. 
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Concept  of  Generalized  Time 


Because  of  the  meaning  ascribed  to  generalized  stress,  it  is  clear 
that  the  corresponding  measure  of  time  may  be  measured  variously  as  the 
age  of  the  system,  the  number  of  system  performances,  the  number  of 
cycles  of  shaft  rotation,  etc.  The  most  appropriate  measure  of  time  must 
be  decided  for  each  specific  application. 

Associated  with  the  periodic  components  of  the  generalized  stress  is 
a  "natural11  time,  given  by  the  actual  time  required  to  complete  1  cycle. 

The  time  to  complete  1  cycle  may  be  taken  to  be  a  characteristic  time,  and 
the  generalized  time  of  the  system  is  equal  to  the  ratio  of  real  time  to  the 
characteristic  time.  If  several  periodic  components  are  present,  the  char¬ 
acteristic  time  may  be  taken  to  be  the  time  to  complete  1  cycle  of  the 
superimposed  components. 

For  the  nonperiodic  components  of  the  generalized  stress,  the  choice 
of  a  time  measure  is  much  more  difficult.  If  a  characteristic  unit  of  time 
can  be  determined,  then  the  generalized  time  of  the  system  is  given  by  the 
ratio  of  the  real  time  to  the  characteristic  time,  as  in  the  case  of  periodic 
phenomena.  However,  because  of  the  absence  of  a  "natural"  time  unit, 
somewhat  artificial  characteristic  times  are  usually  associated  with  non¬ 
periodic  phenomena.  As  an  example,  the  characteristic  time  associated 
with  the  exponential  distribution  of  failures  is  that  time  required  for  the 
probability  of  successful  operation  to  be  reduced  by  the  factor  1/e.  In  gen¬ 
eral,  the  appropriate  time  measure  must  be  decided  separately  for  each 
problem. 


The  Problem  of  Scale  Factors 


In  addition  to  the  practical  difficulties  in  obtaining  suitable  numerical 
measures  for  generalized  stress  and  generalized  time,  a  difficulty  of 
greater  subtlety  is  associated  with  the  choice  of  scale  factors.  Having  suit¬ 
ably  defined  the  characteristic  generalized  stress  and  characteristic  gen¬ 
eralized  time,  a  model  must  be  constructed  with  characteristic  stresses 
and  times  that  give  desirable  scale  factors.  For  example,  it  may  be  de¬ 
sired  that  1  hour  of  model  operation  be  equivalent  to  1000  hours  of  prototype 
operation.  Although  characteristic  times  may  be  obtained  that  yield  this 
ratio,  it  may  occur  that,  by  choosing  such  large  scale  factors,  the  func¬ 
tional  forms  f  and  f'  of  Equation  (18)  are  no  longer  identical.  Moreover, 
because  the  functional  form  of  f  is  not  known,  the  lack  of  identity  that  may 
exist  between  these  functions  is  also  unknown.  On  the  other  hand,  it  is 
known  that,  for  scale  factors  sufficiently  close  to  unity,  the  model  and 
prototype  are  practically  identical  systems,  and  there  is  little  reason  to 
suspect  a  lack  of  identity  between  f  and  f\ 
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One  method  for  partially  avoiding  this  problem  is  the  following.  Sev¬ 
eral  tests  are  made  on  models  that  have  progressively  altered  scale  factors. 
The  functions  associated  with  the  sequence  of  models  are  then  examined  to 
determine  whether  the  functions  change  with  changes  in  scale  factor.  If  the 
functions  do  not  change,  then  the  relation  between  the  model  and  the  proto¬ 
type  is  better  established.  If  the  functions  do  change,  it  is  sometimes  possi¬ 
ble  by  extrapolation  to  obtain  the  function  for  the  prototype. 

The  difficulties  discussed  thus  far  indicate  that  enormous  problems 
exist  in  the  determination  of  reliability  functions  based  on  data  obtained  in 
accelerated  tests.  However,  it  should  not  be  concluded  that,  because  of 
these  difficulties,  model  theory  is  an  inappropriate  method  of  attack.  In¬ 
stead,  the  conclusion  to  be  drawn  is  that,  through  model  theory,  the  diffi¬ 
cult  problem  of  accelerated  testing  can  be  correctly  formulated,  and  con¬ 
sequently,  can  be  attacked  more  sensibly. 


MODEL-PROTOTYPE  RELATIONS  SUITABLE 
FOR  ACCELERATED  TESTING 


It  has  been  shown  in  the  preceding  sections  that  accelerated  testing 
may  be  regarded  as  a  modeling  problem  in  which  it  is  assumed  that  the 
probability  of  failure  is  a  function  of  the  application  of  a  generalized  stress 
over  a  generalized  time.  In  addition  to  the  validity  of  Equations  (14) 
through  (19),  various  assumptions  may  be  made  regarding  the  relations  be¬ 
tween  the  characteristic  stresses  and  characteristic  times  of  the  model  and 
prototype.  If  it  is  assumed  that  the  characteristic  stresses  are  equal,  and 
the  characteristic  time  for  the  model  is  smaller  than  that  of  the  prototype, 
then  a  model -prototype  relation  suitable  for  accelerated  testing  is  obtained. 

Let  S'  and  denote  the  characteristic  stresses  of  the  model  and 
o  o 

prototype,  respectively;  and  let  T'Q  and  T0  denote  the  corresponding  charac¬ 
teristic  times.  Then  the  mathematical  description  of  the  model -prototype 
relation  is  given  by  the  following: 


S0=S'0  (20) 

and 

Tc>Ti,  (21) 


together  with  Equations  (14)  through  (19).  By  writing  Equation  (16)  in  the 
form: 


a 


f 
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it  follows  from  Equation  (20)  that: 


S  =  S' .  (22) 

Thus,  the  generalized  stresses  in  the  model  and  prototype  are  numerically 
equal.  Similarly,  by  writing  Equation  (17)  in  the  form: 


it  follows  that: 

T  =  (^r)T'»  (23) 

so  that  the  prototype  time,  T,  is  obtained  from  the  model  time,  T1 ,  by  multi¬ 
plying  the  model  time  by  the  scale  factor  (T0/T^).  By  Equation  (21),  this 
scale  factor  is  larger  than  unity,  so  that  1  hour  of  model  operation  corre¬ 
sponds  to  more  than  1  hour  of  prototype  operation.  Relative  to  the  prototype, 
the  time  of  the  model  "flows  faster",  and,  consequently,  the  model  may  be 
said  to  be  "accelerated". 

In  order  to  ascribe  practical  significance  to  this  theoretical  formula¬ 
tion,  it  is  necessary  to  obtain  a  characteristic  time  that  is  smaller  for  the 
model  than  for  the  prototype  and,  at  the  same  time,  maintain  equal  stresses 
in  the  two  physical  systems.  Because  an  intentional  "weakening"  of  the 
model  structure  may  destroy  the  equality  of  the  stresses  between  the  model 
and  the  prototype,  it  would  appear  desirable  to  use  identical  structures  for 
both  model  and  prototype.  Under  this  restriction,  changes  in  characteristic 
times  can  be  obtained  only  by  altering  the  use  of  the  two  systems  in  time. 
Moreover,  a  system  that  is  in  operation  most  of  the  time  would  appear  to  be 
ideally  suited  for  modeling  an  identical  system  that  is  operated  only  occa¬ 
sionally.  This  is  particularly  true  for  systems  in  which  the  internal  stresses 
are  more  relevant  to  reliability  than  the  environmental  stresses.  It  is  also 
clear  that,  for  some  systems,  the  actual  number  of  operating  hours  is  not 
the  most  relevant  measure  of  time.  A  better  measure  may  be  given  by  the 
number  of  hours  of  operation  under  those  "abusive"  stresses  that  cause 
significant  "degradation"  of  the  system.  Unless  the  system  is  operated 
continuously  under  abusive  stresses,  the  "effective"  number  of  hours  of 
operation  would  be  less  than  the  actual  number. 

To  make  these  notations  more  definitive,  a  physical  system  is  consid¬ 
ered  for  which  the  following  assumptions  hold: 

(1)  The  stresses  imposed  on  the  system  during  normal  operation 
can  be  classified  as  being  either  abusive  or  nonabusive. 
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(2)  The  probability  of  failure  of  the  system  is  dependent  only 
on  the  cumulated  effects  of  the  abusive  stresses  over  time. 

(3)  The  proportion.  A,  of  the  total  operating  time  for  which  the 
system  is  subjected  to  abusive  stresses  is  known. 

Under  these  assumptions,  a  characteristic  time  may  be  defined  as  follows: 

T0  a  number  of  operating  hours  required  to  accumulate  1  hour 
of  abusive  stress. 

Because  A  is  equal  to  the  ratio  of  cumulated  abuse  hours  to  the  total  op¬ 
erating  hours,  it  follows  that: 


T0  =  1/A. 

Thus,  the  characteristic  time  may  be  defined  to  be  the  reciprocal  of  the 
abuse  ratio,  A.  By  increasing  the  abuse  ratio,  A1,  for  the  model,  the  char¬ 
acteristic  time  for  the  model  can  be  decreased,  as  shown  by: 

To  =  i>xr=:T°-  {24) 

Equations  (23)  and  (24)  then  show  that  the  time-scale  factor  relating  the 
prototype  time  to  the  model  time  is  given  by  (A1  /  A);  that  is, 

T  =  Gf)T'=Gr)T'-  l25' 

Thus,  the  prototype  time  is  equal  to  the  model  time  multiplied  by  the  abuse 
ratio.  A1 /A.  Equation  (25)  also  shows  that  the  maximum  scale  factor,  and 
consequently  the  maximum  "acceleration",  is  obtained  when  A’  s  1,0.  Under 
this  condition,  the  model  accumulates  1  hour  of  abuse  for  every  hour  of  op¬ 
eration,  and  the  prototype -model  times  are  related  by  the  simple  expression: 

t*GDt'*  {z6) 

This  result  shows,  for  example,  that,  for  a  prototype  system  that  accumu¬ 
lates  1  hour  of  abuse  for  each  100  hours  of  operation,  A  =  1/100,  and  the 
,,most  accelerated"  model  yields  1  hour  of  model  operation,  which  is  equiva¬ 
lent  to  100  hours  of  prototype  operation. 

For  highly  reliable  systems,  it  may  be  permissible  to  assume  that  the 
abuse  ratio,  A,  is  very  small,  so  that  many  hours  of  operation  are  required 
to  accumulate  1  hour  of  abuse.  This  means  that,  for  such  systems,  1/A  is 
very  large,  so  that  modeling  of  such  systems  in  reasonably  short  time 
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periods  appears  theoretically  feasible.  However,  the  potential  difficulties 
associated  with  large  scale  factors  require  that  this  conclusion  be  accepted 
with  caution. 


As  a  result  of  the  highly  instrumented  tests  made  on  the  prototype 
system,  it  is  assumed  that  a  specific  set  of  operating  "states",  say 
Ci, ... ,  Cn,  is  found  to  be  abusive.  All  those  operating  states  that  are 
found  to  be  nonabusive  may  be  collectively  labeled  CQ.  The  abuse  ratio  is 
then  given  by  the  fraction  of  the  total  operating  time  spent  in  any  one  of  the 
states  Cj, .  . .  ,  Cn  when  the  system  is  operated  in  normal  use. 


To  make  the  model -theoretic  approach  practical,  it  is  necessary  to 
describe  normal  use  in  quantitative  terms.  This  may  be  done,  for  ex¬ 
ample,  by  determining  the  fraction  of  the  total  operating  time  the  prototype 
system  is  expected  to  exist  in  each  of  the  states  CQ,  C^, . . . ,  Cn  when  op¬ 
erated  in  normal  use.  Let  T(i)  represent  the  number  of  hours  spent  in 
state  i  out  of  T  operating  hours,  so  that  T^)/T  represents  the  fraction  of 
the  total  operating  time  spent  in  state  Ci.  Similarly,  let  the  corresponding 
fraction  for  the  model  be  denoted  by  tW/T1.  The  objective  in  operating  the 
model  is  to  minimize  the  time  spent  in  the  nonabusive  state,  C0.  The  time 
normally  spent  in  state  C0  should  be  distributed  over  the  abusive  states  in 
proportion  to  the  fractions  T^/T.  More  specifically,  let  the  marginal  dis¬ 
tribution  of  operating  time  over  the  abusive  states  be  represented  by 
n  n 


1,. . .  ,  n  for  the  prototype,  and 


by  T(i)' 


T(j)'  for  the 


j=l 

model. 


j=i 

These  distributions  are  made  identical  by  the  requirement: 


T(*>r 

T« 

T(i) 

T' 

i T<i)' 

T' 

j=l 

i  =  1, 


Solving  this  equation  for  tW* /T'  yields: 


n 

\  tU)'  /t1 

T(i)'1 

Lj 

j=i 

T(i) 

T1 

n 

~T 

y  t0)/t 

mrnrnJ 

j=l 

n. 


and  by  definition  of  the  abuse  ratios,  it  follows  that: 
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n. 


This  result  shows  that  the  fraction  of  the  total  operating  time  spent  by  the 
model  in  state  is  obtained  from  the  corresponding  fraction  for  the  proto¬ 
type  by  multiplying  by  the  abuse  ratio.  A1  /A. 


To  obtain  the  time  spent  by  the  model  in  state  CQ,  the  above  equation 
is  first  summed  over  i  to  yield: 

f  T(i) 

L  T’  "\A )  L  T  ' 

i=l  i=l 


which  may  be  written  as: 

t(°)!  +  2T W1  t(°)'  _  /A1  \  t(°)  +  ZT^)  t(°) 

T*  "  T'  J  =  V  A  y  [  T  "“T" 

so  that: 


This  expression  may  be  written  as: 


and,  from  t(°)/T  =  1  -  A  and  T(°)'/T'  =  1  -  A',  it  follows  that: 


and  finally. 

Thus,  for  a  given  set  of  abuse  ratios,  A  and  A1,  the  fraction  of  the  total 
operating  time  spent  by  the  model  in  state  CQ  is  obtained  by  multiplying  the 
corresponding  fraction  for  the  prototype  by  (1  -  A')/(l  -  A). 

The  efficiency  of  the  model-prototype  relation  may  be  defined  by 
E  =  (A'  -  A)/(l  -  A).  For  A'  =  A,  the  efficiency  of  the  model  is  zero,  and 
for  A'  =  1,  the  efficiency  of  the  model  is  100  per  cent.  The  time  spent  by 
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the  model  in  state  CQ  is  expressible  in  terms  of  the  efficiency  of  the  model, 
as  shown  by  the  relation: 


t(°)' 

T' 


=  (1  -  E) 


T(°) 


Thus,  when  the  efficiency  is  zero,  the  model  spends  just  as  much  time  as 
the  prototype  in  the  state  C0;  when  the  efficiency  is  1.0,  the  model  spends 
no  time  in  the  state  CQ. 


Prediction  of  Catastrophic  Failures 
Using  Model  Theory 

The  preceding  results  may  be  applied  to  the  problem  of  predicting 
catastrophic  failures.  To  be  specific,  suppose  it  is  desired  to  determine 
whether  a  turboprop  control  system  meets  a  reliability  requirement  that  it 
have  a  mean  malfunction  rate  with  catastrophic  consequences  of  less  than 
1  in  10  million  flying  hours.  Suppose,  further,  that  such  control  systems 
are  to  be  used  as  models  in  an  accelerated  test  program.  The  preceding 
development  of  model  theory  suggests  the  following  approach  to  the 
problem: 

(1)  Establish  for  the  control  systems  the  characteristic  time, 

T0,  the  number  of  operating  hours  required  to  accumulate 
1  hour  of  abuse  under  normal  operating  conditions.  A 
highly  instrumented  experimental  run  to  estimate  wear 
rates,  temperatures,  voltages,  etc.  ,  may  furnish  this  in¬ 
formation  for  various  operating  conditions. 

(2)  Operate  a  set  of  model  control  systems  under  those  condi¬ 
tions  found  above  to  be  abusive  until  the  first  catastrophic 
failure  occurs  at  time  T‘. 

The  aim  in  Step  (1)  is  to  determine  the  characteristic  time,  TQ,  and, 
hence,  the  abuse  ratio,  A  =  1/T0;  the  aim  in  Step  (2)  is  to  obtain  one  catas¬ 
trophic  failure  of  a  model  system  Operating  with  an  abuse  ratio  A'  as  close 
as  possible  to  the  theoretical  maximum  of  1.0.  The  prediction  of  the  catas¬ 
trophic  failure  rate  for  the  prototype  system  operating  under  normal  condi¬ 
tions  is  then  obtained  under  the  model- prototype  assumptions  for  accelerated 
models  given  in  Equations  (14)  through  (21),  and  by  the  time-scale  factor 
relation  given  in  Equation  (25).  As  an  example,  suppose  the  abuse  ratio.  A, 
is  found  to  be  0.  001,  so  that  1  hour  of  abuse  is  accumulated  for  every  1000 
hours  of  operation.  Then  suppose  that  10  models  are  simultaneously  op¬ 
erated  at  abuse  ratios  A1  =  0.90,  so  that  9  hours  of  abuse  are  accumulated 
in  every  10  hours  of  operation  for  each  model.  The  time-scale  factor  for 
this  case  is  then  given  by  A* /A  0.90/0.  001  =  900,  so  that  1  hour  of  model 
operation  is  equivalent  to  900  hours  of  prototype  operation.  Finally, 
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suppose  that,  among  the  10  models  on  test,  the  first  failure  occurs  after 
1000  hours  of  operation.  The  model-prototype  relations  then  show  that  this 
is  equivalent  to  observing  1  failure  out  of  10  prototype  systems  operating 
under  normal  conditions  at  the  end  of  (900)(1000)  =  9  x  10®  hours.  Because 
this  is  the  smallest  failure  time  out  of  10  operating  units,  the  next  problem 
is  to  use  this  information  to  estimate  the  reliability  associated  with  the 
population  of  prototype  control  systems. 


Let  f(t)  denote  the  unknown  probability  density  function  for  failure 
times  associated  with  control  systems  operated  under  normal  conditions. 
The  probability  density  function  for  the  smallest  failure  time  in  a  set  of  n 
observed  failures  is  given  by: 

g(t)  =nf(t)[l  -  F(t)]11-1,  (27) 


where  F(t)  denotes  the  cumulative  density  function  associated  with  f(t).  The 
cumulative  density  function  associated  with  g(t)  is  then  given  by  integration 
of  g(t)  from  0  to  t,  as  shown  by: 

t 

G(t)  =  J  g(u)  du  = 

0  0 


t 

y  nf(u)  [  1  -  F(u)]n“l  du. 


and  integration  of  the  right  side  yields: 


t 

G(t)  =  -[1  -F(u)]n|  , 
0 


so  that: 


G(t)  =  -1  +  [1  -  F(t)]n. 

Solving  for  F(t),  there  results: 

F(t)  =  1  -  [  1  -  G(t)]l^n. 

Now  G(t)  represents  the  area  to  the  left  of  t  in  the  distribution  of  smallest 
failure  times  among  n  failure  times  and  may  be  called  a  p**1  fractile. 
Similarly,  F(t)  represents  the  area  to  the  left  of  t  in  the  distribution  of  fail¬ 
ure  times  within  the  population  of  control  systems,  and  may  be  called  a 
pth  fractile.  Thus,  the  fractiles  of  the  two  distributions  are  related,  as 
shown  by: 


P  =  1  -  [  1  -  p]l/n#  (28) 

Figure  12  shows  a  plot  of  P  as  a  function  of  n  for  p  =  0.  50  and 
p  =  0.90.  The  figure  shows,  for  example,  that,  with  a  sample  of  size  10, 
the  probability  is  0.  50  that  7  per  cent  of  the  future  observations  will  be 

WADCTR  59-106  79 


I 


•WSWeeMlaieeiSWIW***  ■ 


FIGURE  12.  ESTIMATED  PER  CENT  OF  FUTURE  FAILURE  TIMES 
EXPECTED  TO  BE  LESS  THAN  THE  SMALLEST 
OBSERVED  FAILURE  TIME 

The  probability  is  p  that  less  than  P  per  cent  o£  future 
failure  times  will  be  smaller  than  the  smallest  deserved 
failure  time  among  a  set  of  n  models  subjected  to 
accelerated  tests. 
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smaller  than  the  smallest  observation  in  a  sample  of  size  10.  Similarly, 
the  probability  is  0,90  that  21  per  cent  of  the  future  observations  will  be 
smaller  than  the  smallest  observation  in  a  sample  of  size  10,  It  should  be 
noted  that  no  assumptions  involving  the  forms  of  the  distributions  are  made 
in  this  formulation. 

In  the  example  of  the  turboprop  control  system,  it  may  be  concluded 
with  50  per  cent  confidence  that  the  probability  is  less  than  0.  07  that  a 
randomly  selected  control  system  will  have  a  failure  time  smaller  than 
9  x  105  hours;  it  may  be  concluded  with  90  per  cent  confidence  that  the 
probability  is  less  than  0.  21  that  a  randomly  selected  control  system  will 
have  a  failure  time  less  than  9  x  105  hours. 


In  some  instances,  it  may  be  possible  to  terminate  the  accelerated 
tests  before  catastrophic  failure  occurs  for  one  of  the  models.  As  an  ex¬ 
ample,  suppose  the  reliability  requirement  takes  the  following  form:  It 
must  be  demonstrated  with  50  per  cent  confidence  that  the  probability  is 
less  than  0.05  that  the  system  will  suffer  a  catastrophic  failure  within  10^ 
operating  hours.  Suppose  the  model  and  prototype  abuse  ratios  are  given 
by  A1  =  0.90  and  A  =  0.  001,  respectively.  Then  from  Equation  (25)  it  fol¬ 
lows  that,  to  obtain  the  equivalent  of  10^  operating  hours  with  the  prototype 
system,  the  models  must  be  operated  without  a  failure  for: 


T  _  106 
(A' /A)  =  900 


1, 100  hours. 


The  number  of  models  to  test  is  obtained  either  from  Figure  12,  or  from 
Equation  (28),  by  solving  for  the  value  of  n  corresponding  to  given  values  of 
p  and  P.  The  solution  yields: 


n 


-  -  P) 

In  (1  -P)' 


and  for  p  s  0,50  and  P  =  0.  05  for  the  example,  it  follows  that  n  is  approxi¬ 
mately  equal  to  14.  Thus,  if  14  models  are  subjected  to  accelerated  tests 
with  an  abuse  ratio  of  0.90  for  1,100  hours  of  operation  without  a  failure, 
then  the  tests  may  be  terminated  and  it  may  be  concluded  with  50  per  cent 
confidence  that  the  probability  is  less  than  0.  05  that  the  prototype  system 
will  suffer  a  failure  within  10^  operating  hours.  If  the  reliability  require¬ 
ment  had  been  stated  as  a  confidence  level  of  0.  50  that  there  is  less  than 
one  chance  in  a  1000  of  a  failure  in  10^  operating  hours  and  with  an  abuse 
ratio  of  900,  as  above,  then  11.1  hours  of  testing  on  each  of  700  models 
would  be  required.  - 

It  may  be  noted  that  the  preceding  conclusions  do  not  give  estimates 
of  the  mean  life  of  the  control  systems.  In  particular,  the  question  of 
whether  the  control  system  meets  a  reliability  requirement  of  an  average 
failure  rate  of  less  than  1  in  10?  operating  hours  has  not  been  answered  in 
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the  example.  Instead,  it  has  been  concluded  with  90  per  cent  confidence 
that  less  than  21  per  cent  of  the  control  systems  will  have  failures  in  fewer 
than  9  x  10®  operating  hours.  It  is  believed,  however,  that  the  conclusion 
illustrated  in  this  example  may  have  more  practical  value  than  a  conclusion 
concerning  mean  life.  The  reason  for  this  belief  is  shown  by  the  following 
argument.  A  mean-life  estimate  yields  a  measure  of  the  •'location'1  of  a 
distribution  in  the  sense  of  a  center  of  gravity  and  generally  does  not  indi¬ 
cate  the  ••spread1'  or  dispersion  of  the  distribution  about  its  center  of  gravity. 
However,  for  the  prediction  of  catastrophic  failures,  the  primary  concern  is 
with  that  "tail"  of  the  distribution  that  contains  early  failures.  Estimates  of 
interest  to  the  prediction  of  catastrophic  failures  should  give  the  ••size"  of 
this  tail.  This  is  precisely  the  form  of  the  conclusion  obtained  for  the 
turboprop  example.  With  90  per  cent  confidence,  the  '•size11  of  the  tail  con¬ 
sisting  of  failures  that  occur  within  9  x  10®  operating  hours  is  estimated  to 
be  less  than  21  per  cent  of  the  control  systems.  When  the  size  of  the  tail  is 
very  small,  say  1  per  cent  with  95  per  cent  confidence  for  the  number  of 
operating  hours  of  interest,  it  may  be  asserted  that  the  reliability  of  the 
system  is  very  high,  even  though  the  form  of  the  failure  distribution  and  its 
mean  life  are  not  known. 


The  Use  of  the  Exponential  Distribution 
of  Failure  Times  in  the  Model-Theoretic 
Approach  to  Reliability 

In  the  preceding  sections,  the  form  of  the  distribution  of  failure  times 
was  not  assumed.  However,  the  incorporation  of  this  type  of  assumption 
into  the  model -theoretic  formulation  is  straightforward.  Some  of  the  re¬ 
sults  derived  from  the  assumption  of  an  exponential  distribution  of  failure 
times  are  given  here. 

In  the  application  to  catastrophic  failures,  n  failure  times  are  not 
actually  observed.  Instead,  after  the  first  catastrophic  failure  has 
occurred  among  the  n  models,  the  tests  are  stopped.  It  is  easily  seen, 
however,  that  the  following  argument  remains  valid,  because  the  last  (n  -  1) 
failure  times  are  not  used  in  estimating  mean  life. 

The  probability  density  function  for  an  exponential  distribution  of  fail¬ 
ure  times  for  the  models  is  given  by: 

f(t')  =^e-t'/T',  t'>0,  (29) 

where  the  constant  r 1  denotes  the  mean  time  tc  failure.  Integration  of  this 
expression  between  0  and  t1  yields  the  cumulative  density  function: 

F(t')  =  1  -  e-t'/T\  t'  >0, 
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and  substitution  of  these  two  expressions  into  Equation  (27)  yields: 


g(t')  e-itf'/T',  t'  >0. 

T 


(30) 


This  result  represents  the  probability  density  function  for  the  smallest  fail¬ 
ure  time  in  a  set  of  n  failure  times  drawn  from  an  esqponential  distribution. 
The  expected  value  of  the  smallest  failure  time  is  given  by: 


00 

E(t')  =  y  t'g(t')dt' 
0 


e-nt'/r'  dt'. 


and  integration  yields: 


E<t\ 


(31) 


Thus,  an  unbiased  estimate  of  the  mean  life  for  the  models  is  given  by: 

T'  =  nT! , 

where  T1  is  the  smallest  observed  failure  time  among  the  n  models  on  test. 

As  shown  in  Equation  (25),  prototype  time  is  obtained  from  model 
time  by  multiplying  the  model  time  by  the  scale  factor,  A1  /A.  The  following 
argument  shows  that,  if  the  model  failure  times  are  assumed  to  be  ex¬ 
ponentially  distributed,  with  a  mean  life  of  r1,  then  the  prototype  failure 
times  are  also  exponentially  distributed,  with  a  mean  life  of  r'  (A1 /A). 

The  element  of  probability  corresponding  to  Equation  (29)  is  given  by: 

f(t')dt'  =  —  e-t'/T'  dt',  t.  >o. 

T1 


Elimination  of  t1  and  dt'  using: 

t  *  (A1  /A)t*  , 

and 

dt  =  (A1  /A)dtr 

yields  the  transformed  element  of  probability, 

g(.)d«  ■  (A)  .-(1/T')(A/A’)t  (A)  dt,  t  >0, 

which  may  be  written  as: 
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g(t)dt  = 


1 

r'(A'  /A) 


e"t/r'(A'/A)  dt^  t  >  o. 


This  result  has  the  form  of  an  exponential  distribution,  and  shows  that  the 
prototype  failure  time  is  exponentially  distributed,  with  a  mean  life  given  by: 

T  =  r  '(A1  /A).  (32) 

Equation  (31)  may  also  be  used  to  obtain  an  unbiased  estimate  of  the 
mean  life  of  the  prototype  system,  for: 

E  <nt'>-  T1, 


and,  consequently. 


f  /  1  /a'\ 


T  “  T  , 


This  result  shows  that  an  unbiased  estimate  of  r,  the  mean  life  of  the  proto¬ 
type  systems  is  given  by: 


T  = 


(33) 


where  T*  is  the  observed  time  to  failure  among  a  set  of  n  models,  and 
(A1  /A)  is  the  time -scale  factor. 


Estimation  of  the  Probability  of 
Catastrophic  Failures  for  Various 
Operating  Time  Periods 

By  combining  the  assumption  of  an  exponential  distribution  of  failure 
times  with  Equation  (28),  estimates  of  the  probability  of  catastrophic  fail¬ 
ures  for  various  time  periods  can  be  obtained.  To  show  this,  assume  that 
the  first  model  failure  occurred  after  T'  hours.  Then  the  corresponding 
time  of  failure  for  the  prototype  is  T'(A!/A),  and,  under  the  assumption  that 
the  prototype  failure  times  are  exponentially  distributed,  With  a  mean  life 
of  T,  it  follows  that: 


P  =  1  -  exp  -T.'1tAI ,  (34) 

where  P  is  obtained  from  Equation  (28)  for  a  fixed  value  of  p.  This  equation 
may  be  solved  for  T  to  obtain: 


WADC  TR  59-106 


84 


1 


(35) 


T*n 


Comparison  of  this  result  with  Equation  (33)  shows  that  the  estimate  of 
mean  life  given  above  is  biased  unless  1/(1  -  p)  =  e,  for  which  p  =  1  -  1/e  = 
0.  63.  For  values  of  p  greater  than  0.63,  the  estimate  given  in  Equation  (35) 
will  be  "conservative"  in  the  sense  that  the  mean  life  of  the  prototype  sys¬ 
tem  will  be  underestimated.  Thus,  if  p  denotes  the  "confidence"  in  the 
mean  life  conclusions,  then  confidence  increases  as  the  mean  life  is  in¬ 
creasingly  underestimated. 


The  probability  of  failure  for  the  prototype  in  T  operating  hours  is 
given  by: 


PT=7  £  e-t/Tdt, 


where  t  denotes  prototype  time.  Integration  yields 

PT  »  1  -  e-T/T, 

and  substitution  for  T  using  Equation  (35)  yields: 

PT  =  1  -  (1  -  P)1/n*,  (36) 


where 


(37) 


A  comparison  of  this  result  with  Equation  (28)  shows  that  n*  may  be  re¬ 
garded  as  an  "effective"  sample  size  for  the  model  tests.  The  product 
A^*  represents  the  total  number  of  abuse  hours  accumulated  by  the  model 
before  it  failed  at  time  T!.  Similarly,  the  product  AT  represents  the  total 
number  of  abuse  hours  accumulated  by  the  prototype  in  T  hours.  It  should 
be  noted  that  A1,  T1,  and  A  are  fixed  quantities,  whereas  T  may  be  varied. 


Equation  (37)  may  also  be  written  as: 


n 


* 


(T'/Tjj 

(T/Tq) 


in  accordance  with  Equations  (24)  and  (25),  where  and  TQ  denote  the 
characteristic  times  of  the  model  and  prototype,  respectively.  This  result 
shows  that  the  effective  number  of  models  is  multiplied  by  the  ratio  of  the 
intrinsic  model  time  to  the  intrinsic  prototype  time. 
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As  an  example  of  the  use  of  Equations  (36)  and  (37),  suppose  the  abuse 
ratio  for  the  turboprop  control  system  is  determined  to  be  0.  001  under  nor¬ 
mal  operation,  so  that  1  hour  of  abuse  is  accumulated  for  every  1000  hours 
of  operation.  Suppose  further  that  10  models  are  operated  at  abuse  ratios 
of  0.90  and  the  first  model  failure  occurs  after  1000  hours  of  Gyration.  It 
is  desired  to  estimate  the  probability  of  failure  for  the  control  system  op¬ 
erating  under  normal  conditions  for  10^  hours.  Under  these  conditions, 

A  =  0.  001,  A1  =  0.  90,  T'  =  1000  hours,  T  =  10^  hours,  and  n  »  10,  so  that: 


n*  = 

(0.001)(106) 


(10)  =  9. 


Thus,  the  "effective”  number  of  models  is  9,  and  Figure  12  may  be  used  to 
determine  using  a  sample  size  of  9.  This  procedure  shows  that  P»p  is 
approximately  0.  22  with  90  per  cent  confidence.  Thus,  it  is  concluded  with 
90  per  cent  confidence  that  the  probability  of  failure  of  the  prototype  system 
when  operated  for  10^  hours  under  normal  conditions  is  equal  to  0.  22.  By 
repeating  this  computation  for  various  values  of  T,  the  failure  probabilities 
of  the  prototype  system  over  a  range  of  operating  times  may  be  obtained. 


A  GENERAL  MODEL -PROTOTYPE  RELATION 
FOR  ACCELERATED  TESTING 


In  the  simple  model -prototype  relation  for  accelerated  testing,  it  is 
assumed  that  the  environmental  stresses  are  negligible  relative  to  the  in¬ 
ternal  stresses  of  the  system.  In  the  remainder  of  this  report,  a  more 
general  relation  is  developed  in  which  the  effects  of  the  environmental  and 
internal  stresses  are  both  included. 


Decomposition  of  the  Generalized  Stress 

Suppose  that  the  generalized  stress  is  a  function  of  generalized  time, 
so  that  S  =  S(T).  Further,  suppose  the  generalized  stress  may  be  decom¬ 
posed  into  a  mean,  or  nonperiodic,  component,  Sj^(T),  and  a  cyclic,  or 
periodic,  component,  S^(T),  so  that: 

S(T)  =  Sm(T)  +  SA(T), 

where  it  is  assumed  that  the  component  stresses  are  additive.  If  the  gen¬ 
eralized  mean  stress  is  very  small  relative  to  the  periodic  stress,  then  it 
may  be  neglected.  This  is  shown  by  writing  the  preceding  equation  in  the 
form: 
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S(T)  =  Sa(T) 


where 


implies  that: 


1 


I  SM<T) 

sa<t> 


sm*t| 

sa(T) 


«1 


S(T)  =  Sa(T). 


Similarly,  if  the  periodic  stresses  are  small  relative  to  the  nonperiodic 
stresses,  it  is  found  that: 


S(T)  =  Sm(T). 

For  intermediate  cases,  the  ratio  of  the  magnitude  of  the  periodic  to  the 
nonperiodic  stress  is  useful  in  characterizing  the  composition  of  the  total 
stress.  Thus,  let; 

,  .  sa(T) 

“  SM(T)  ' 

and  note  that  the  total  stress  is  characterized  as  nonperiodic  or  periodic, 
according  to  whether  X  is  zero  or  infinite. 


The  Stress -Range  Diagram 

The  preceding  characterization  of  the  total  generalized  stress  is 
analogous  to  the  representation  of  combined  periodic  and  nonperiodic 
stresses  imposed  on  a  specimen  in  metal-fatigue  studies.  Figure  13  is  a 
sketch  of  an  illustrative  "  stress  -range  diagram"  used  in  such  studies. 

For  fatigue  studies,  Sj^£  represents  the  mean  stress  applied  to  the 
specimen,  and  represents  the  amplitude  of  the  alternating  stress  applied 
to  the  specimen.  The  axes  are  scaled  linearly  in  the  plot  and  the  rays 
emanating  from  the  origin  have  slopes  equal  to  X.  Thus,  for  X  =  0,  the 
alternating  stress  is  zero,  and  for  X  =  oo  ,  the  mean  stress  is  zero.  For 
intermediate  values  of  X,  the  specimen  is  subjected  to  a  combined  mean 
and  alternating  stress.  The  curved  contours  represent  constant  times  to 
failure,  with  increasing  times  to  failure  in  those  contours  nearer  the  origin. 
The  point  designated  by  A  on  the  plot  shows  that  a  specimen  subjected  to  a 
combined  mean  stress  of  50  x  10^  lb/in.  2  and  an  alternating  stress  of 
10  x  10^  lb/in.  2  is  expected  to  fail  after  10  hours  of  testing.  The  value  of 
X  for  this  case  is  0.  20 ,  For  the  same  value  of  X,  that  is,  for  the  same 
ratio  of  alternating  stress  to  mean  stress,  the  time  to  failure  is  shown 
along  the  ray  OA.  The  point  B  indicates  that  a  specimen  tested  at  the  same 
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.Alternoting  Stress, lOOOpsi  SA .Alternating  Stress,  IOOO  psi 


FIGURE  13.  STRESS -RANGE  DIAGRAM  USED  IN 
METAL-FATIGUE  STUDIES 


SM, Mean  Stress,  lOOOpsi  a-sooss 


FIGURE  14.  STRESS-RANGE  DIAGRAM  WITH 
FAILURE  PERCENTILES 
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value  of  X  but  at  a  lower  mean  stress,  equal  to  30  x  103  lb/in.  is  expected 
to  fail  after  1000  hours.  Along  the  contour  lines,  the  expected  time  to  fail¬ 
ure  is  constant.  These  curves  represent  the  "trade -off**  curves  between 
mean  stress  and  alternating  stress  for  a  specified  time  to  failure.  The 
points  A  and  C  indicate  that  the  same  time  to  failure  is  expected  for  a  com¬ 
bination  of  Sj^  =  50  x  103  lb/in.  2  and  =  10  x  10^  Ib/in.  2  as  for  the  com¬ 
bination  of  Sj^  =  10  x  10^  lb/in.  2  and  =  30  x  10^  lb/in.  2. 

In  this  interpretation  of  the  stress-range  diagram,  the  time  to  failure 
is  the  expected,  or  arithmetic -me an,  time  to  failure  observed  in  testing  a 
set  of  specimens  at  the  test  conditions.  It  is  clear  that  a  criterion  other 
than  the  arithmetic  mean  may  be  used  as  a  basis  for  the  stress -range  dia¬ 
gram.  If  sufficient  data  are  available,  the  0.  10,  0.  50,  and  0.90  percentiles 
may  be  used,  as  shown  for  one  contour  in  Figure  14 *  For  this  point,  10  per 
cent  of  the  models  tested  at  a  generalized  mean  stress  of  50  x  10^  lb/in.  2 
and  a  generalized  alternating  stress  of  7  x  10^  lb /in.  2  failed  after  a  general¬ 
ized  time  of  T  »  10  hours.  An  analogous  statement  is  valid  for  the  point  C. 

Finally,  it  is  desirable  to  express  the  generalized  stress -range  dia¬ 
gram  in  a  dimensionless  form,  as  shown  in  Figure  15.  The  justification  for 
the  changes  in  symbolism  shown  in  Figure  15  is  obtained  from  the  assump¬ 
tion  that  the  probability  of  failure  is  e^qpressible  as  a  function  of  a  =  S/S0 
and  r  =  T/Tc;  that  is, 


p  =f(0,T)  =f(S/S0,T/T0). 

This  representation  of  p  is  generalized  to  indicate  the  decomposition  of  S 
into  a  periodic  component,  S^,  and  a  nonperiodic  component,  S|^,  as  shown 
by: 


S  =  SA  +  SM  =  SM 


1  +■ 


5M 


=  SM  (1  +  X). 


Division  by  the  characteristic  stress,  SQ,  yields: 

2>0  2>o 


where  S^/SQ  and  X  are  mathematically  independent.  Thus,  (S/S0)  in  the 
functional  representation  of  p  must  be  replaced  by  two  variables,  (Sj^/S0) 
and  X: 


tfs u  ,  t'N 

p  ’  V  sT  ’  ’  %  )■ 
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°M  .Intrinsic  Generalized  Nonperiodic  Stress 

FIGURE  15.  DIMENSIONLESS  FORM  OF  STRESS-RANGE  DIAGRAM 


FIGURE  16.  HYPOTHETICAL  SKETCH  OF  THE  PERIODIC  PROPORTION 
OF  TOTAL  STRESS  AS  A  FUNCTION  OF  TIME 
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Alternatively,  the  variables  involved  in  the  functional  form  of  p  may  be 
written  as  follows ; 


P  -  g 


Because  the  ratio  of  (S^/S0)  to  (Sj^/S0)  is  equal  to  X,  the  second  form  is 
clearly  equivalent  to  the  first  form.  Although  both  of  these  forms  appear  to 
have  certain  advantages,  the  second  form  will  be  used  in  the  following  dis¬ 
cussions.  By  defining  the  intrinsic  generalized  periodic  stress  by 
a  A  -  S^/SQ  and  the  intrinsic  generalized  nonperiodic  stress  by  =  S^/Sq, 
the  form  for  p  becomes: 


P  =  f  (oM>  oA,  r). 


The  advantages  of  the  ge  neralized  stress -range  diagram  are  made 
evident  by  noting  that  the  mo  del -prototype  relations  become: 


(1) 

aM 

*  aM' 

(2) 

aA 

=  Oft.' 

(3) 

T  = 

r' , 

(4) 

f  = 

f  , 

(5) 

S 

o 

=  <So>' 

(6) 

To 

*  <T0 )' 

The  generalized  stress-range  diagram  explicitly  involves  the  quantities 
an<*  T%9  an<*  these  are  numerically  equal  to  the  corresponding 
quantities  for  the  prototype.  Consequently,  the  contour  lines,  which  are 
plotted  according  to  the  results  of  the  tests  on  the  models,  may  be  read 
directly  as  applying  to  the  prototype.  This  assumes,  of  course,  that  the 
functions  f  and  f1  have  not  changed  in  the  transition  between  model  and 
prototype.  The  model  time  associated  with  the  plot  is  converted  to  proto¬ 
type  time  by  use  of  the  time -scale  factor. 


Complications  Involved  in  Time  Dependence 

The  preceding  discussion  of  the  generalized  stress-range  diagram  is 
based  on  the  assumption  that  X  is  not  a  function  of  time.  That  is,  it  is 
assumed  that  the  ratio  of  the  generalized  periodic  stress  to  the  generalized 
nonperiodic  stress  is  constant  during  the  life  of  the  system.  For  a  system 
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that  is  sometimes  in  storage ,  sometimes  in  a  state  of  "mild"  operation,  and 
sometimes  in  a  state  of  ,,severen  operation,  it  is  clear  that  the  assumption 
of  a  constant  ratio  of  over  time  is  not  valid.  To  account  for  various 

states  of  operation,  the  explicit  dependence  of  X  on  time  is  required.  For 
many  systems,  such  a  dependence  may  be  extremely  difficult  to  formulate. 


Alternative  Representation  of 
Stress  Decomposition 

From  the  equations  shown  previously,  the  intrinsic  generalized  stress 
may  be  represented  by: 


0  -  +  X), 

where  X  ranges  between  0  and  oo.  The  range  of  X  does  not  permit  a  con¬ 
venient  description  of  time  dependence  by  graphical  plots.  Consequently, 
the  factor  X  is  replaced  by  a  factor  that  is  more  suitable  for  graphic 
representation. 

From  the  relations: 


and 


SA  +  SM  =  S 


SA/SM  =  X ' 


it  follows  that: 


SA/S  =  X/(l  +  X). 

Thus,  the  ratio  X/(l  +  X)  represents  the  fraction  of  the  total  generalized 
stress  that  is  periodic.  This  ratio  is  represented  by  ji,  so  that: 

\x  =  X/(l  +  X). 

It  is  clear  that,  as  X  ranges  between  0  and  oo,  fi  ranges  between  0  and  1. 

With  this  definition  of  ju,  the  time  dependence  of  X  induces  a  time 
dependence  of  jlx.  For  illustrative  purposes,  it  is  supposed  that  Figure  16 
represents  a  plot  of  fi  as  a  function  of  actual  time.  The  sketch  indicates 
that  the  system  is  first  subjected  to  a  stress  that  is  approximately  10  per 
cent  periodic.  At  time  t\,  the  system  is  subjected  to  an  operation  having 
a  50  per  cent  periodic  component.  The  segmented  curve  represents  an 
approximation  to  the  smooth  curve  under  various  time  intervals.  Figure  17 
shows  a  plot  of  the  intrinsic  generalized  periodic  stress  as  a  function  of 
time.  The  smooth  curve  is  again  approximated  by  average  values  taken 
over  the  same  time  intervals  as  those  used  in  the  plot  of  fx . 
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FIGURE  17.  HYPOTHETICAL  SKETCH  OF  INTRINSIC  GENERALIZED 
PERIODIC  STRESS  AS  A  FUNCTION  OF  TIME 


<rul  Intrinsic  Generalized  Nonperiodic  Stress 

M  A-30097 


FIGURE  18.  TIME  TRAJECTORY  OF  A  SYSTEM  PLOTTED  ON  A 
GENERALIZED  STRESS-RANGE  DIAGRAM 
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The  corresponding  values  of  ji  and  obtained  from  the  two  preceding 
figures  are  next  plotted  on  the  generalized  stress -range  diagram.  The  re¬ 
sult  is  a  time  trajectory  on  the  stress-range  diagram,  which  is  suggested 
by  Figure  18,  where  it  has  been  assumed  that  real  time  and  generalized 
time  are  identical  for  this  example.  As  indicated  on  the  figure,  the  system 
begins  its  trajectory  at  point  A  and  traverses  the  path  to  the  point  D.  The 
computation  of  the  first  point  of  the  trajectory  is  outlined  as  follows:  For 
the  first  time  interval,  the  two  preceding  sketches  indicate  that  ji  =  0.  1  and 
Gj^  =  0.  5.  From  X  =  |i/(l  -  /x),  it  follows  that  X  =  1/9,  and  from  =  a^/X, 
it  follows  that  aM  =  4.5.  The  point  (a^,  =  (0.3,  4.  5)  is  shown  as  A  in 

Figure  18.  The  successive  points  B,  C,  and  D  were  obtained  in  a  similar 
manner  and  were  then  joined  by  the  smooth  curve  shown  in  the  sketch.  As 
indicated  in  the  sketch,  the  point  D  shows  the  trajectory  has  crossed  the 
contour  representing  a  probability  of  failure  of  more  than  10  per  cent.  If 
this  trajectory  were  based  on  averages  obtained  from  model  testing,  then 
the  conclusion  would  also  hold  for  the  prototype;  that  is,  at  point  D,  the 
prototype  has  a  failure  probability  that  exceeds  10  per  cent.  The  prototype 
time  associated  with  this  probability  is  obtained  from  the  model  time  by 
using  the  time -scale  factor. 


Interpretation  of  Trajectory  on 
Stre 8  8 -Range  Diagram 

To  clarify  the  meaning  of  the  time -trajectory  plot  on  the  stress -range 
diagram,  it  is  convenient  to  consider  a  special  case.  Suppose  jx  and  Oj^  are 
both  constant  over  time,  so  that  plots  of  these  quantities  appear  as  shown  in 
Figure  19.  From  the  plot  of  /x,  it  is  seen  that  fX  =  0.  10,  so  that  10  per  cent 
of  the  total  generalized  stress  is  periodic.  From  the  relation: 

‘“■(nrO  ffA' 

it  follows  that: 


aM  =  9/2  *4.  S. 

Thus,  the  point  with  coordinates  (Oj^,  cr^)  =  (4.5,  0,  50)  represents  a  com¬ 
ponent  subjected  to  a  total  generalized  stress,  o^,  given  by: 

aT  "  aM  +  °A  =  ®  +  0.5  =  5.0, 

of  which  10  per  cent  is  a  periodic  component.  This  point  is  shown  in 
Figure  18  as  point  A,  and  by  extrapolation  of  the  values  shown  on  the  stress - 
range  contours,  it  is  seen  that  the  probability  that  the  component  will  fail 
within  T*  hours  is  equal  to  0.005,  approximately.  In  this  special  case,  the 
entire  "trajectory"  is  concentrated  at  the  point  A,  so  that  the  point  does  not 
describe  a  path.  It  is  under  this  condition  that  the  stress-range  diagram 
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fi ,  Fraction  of  Total  Stress  p  .Fraction  of  Total  Stress 

Which  is  Peroidic  Which  is  Periodic 


FIGURE  19.  HYPOTHETICAL,  PLOTS  OF  SYSTEM  STRESSES 
AS  A  FUNCTION  OF  TIME 


A-  300*8 


FIGURE  20.  HYPOTHETICAL  BOUNDS  ON  SYSTEM  STRESSES 
AS  A  FUNCTION  OF  TIME 
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customarily  applies.  The  extension  of  the  diagram  to  include  a  point  that 
moves  with  time  is  not  ordinarily  considered  in  metal-fatigue  studies. 

As  a  second  special  case,  consider  a  component  that  remains  at  the 
point  A  for  a  number  of  hours  equal  to  0.75  T*,  and  for  the  remaining 
0.  25  T*  hours  assumes  stress  conditions  that  characterize  the  point  B  in 
Figure  18;  namely,  =  3.0  and  a .  =0.5.  If  the  path  between  A  and  B  is 
considered  to  be  described  in  an  infinitesimally  short  period  of  time,  then, 
for  practical  purposes,  it  is  permissible  to  consider  the  component  to  be 
located  at  A  for  0.75  T*  hours  and  then  located  at  B  for  0.  25  T*  hours.  It 
is  desired  to  determine  the  probability  that  the  component  will  fail  within 
T*  hours.  From  Figure  18,  it  is  seen  that: 

(1)  If  the  component  stayed  at  A  for  T*  hours,  then  the  prob¬ 
ability  of  failure  within  T*  hours  would  be  equal  to  0.  05, 
approximately,  and 

(2)  If  the  component  stayed  at  B  for  T*  hours,  then  the  prob¬ 
ability  of  failure  within  T*  hours  would  be  equal  to  0.  01, 
appr  oximate  ly . 

From  these  observations,  one  method  for  determining  the  probability  of 
failure  associated  with  a  component  at  A  7£  per  cent  of  the  time  and  at  B 
25  per  cent  of  the  time  is  given  by  p  =  (0.75)  (0.  05)  +  (0.  25)  (0.01)  =  0.  04. 
That  is,  the  probabilities  at  A  and  B  are  weighted  in  proportion  to  the  time 
spent  at  A  and  B,  respectively.  More  generally,  if  a  component  may  be 
regarded  as  located  at  point  A  for  (t^/T*)  hours  and  at  point  B  for  (tg/T*) 
hours,  where  t^  +  tjj  =  T*,  then  an  average  probability  to  associate  with 
the  trajectory  consisting  of  the  points  A  and  B  is  given  by  p  =  (t^/T*)  p A  + 

(tfi/T*)  pg  *  (*apA  +  *BpB 

If  the  trajectory  is  composed  of  a  sequence  of  M  discrete  points,  then 
the  average  probability  of  failure  may  be  represented  by: 

M 

p  =  Pi  At^,  i  =  1 ,  •  •  • ,  M, 

i=l 


where  M 

^  Ati  =  T*, 
i=l 

and  Atj/T*  denotes  the  proportion  of  the  total  time  spent  by  the  system 
under  stress  conditions  having  an  associated  probability  of  failure  given 
by  pi.  Generalizing  still  further,  if  the  number  of  points  becomes  arbi¬ 
trarily  large,  so  that  n  -*•  *>,  then  the  probability  of  failure  is  given  by: 
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M  T* 

P  =  M1^3ooT*  Z  piAtiaT*  y  P(t)dt. 

i=  1  0 

If  the  trajectory  is  represented  by  a  smooth  curve  on  the  generalized  stress 
range  diagram,  then  the  above  equation  associates  a  probability  with  the 
trajectory.  In  general,  this  equation  indicates  that  the  average  probability 
of  failure  varies  with  the  path  taken  between  two  points,  A  and  B. 


Difficulties  in  Interpretation  of 
Trajectory  Diagram 

In  the  preceding  development,  several  important  assumptions  are 
made.  For  example,  it  is  assumed  that  the  stress-range  contours  do  not 
change  with  time.  That  is,  the  stress -range  contours  are  assumed  to  form 
an  invariant  grid  within  which  the  failure  probabilities  may  be  read  by 
interpolation.  This  assumption  needs  careful  consideration,  as  evidenced 
by  the  fact  that  at  point  B  of  Figure  18,  for  example,  the  system  has  under¬ 
gone  a  stress  environment  represented  by  the  path  from  A  to  B.  The  sys¬ 
tem  at  B  has  been  "pre  stressed",  and,  consequently,  its  failure  probability 
may  be  different  from  that  of  a  system  that  has  not  been  prestressed.  The 
difference  is  more  clearly  brought  out  by  considering  a  system,  K,  that 
remains  at  point  A  for  75  per  cent  of  the  total  time,  and  then  undergoes  the 
stress  environment  associated  with  point  B  for  the  remaining  25  per  cent  of 
the  time.  The  "state"  of  such  a  component  may  be  contrasted  with  the 
"state"  of  a  second  component,  K’ ,  that  remains  throughout  the  time  inter¬ 
val  at  conditions  associated  with  point  B.  The  difference  in  state  between  K 
and  K"  after  75  per  cent  of  the  total  time  has  elapsed  is  this:  System  K  has 
been  subjected  to  a  stress  environment  represented  by  point  A,  whereas 
system  K1  has  been  subjected  to  a  stress  environment  represented  by 
point  B.  Both  of  these  environments  maybe  regarded  as  "prestressing" 
stages  for  a  time  interval  consisting  of  the  last  25  per  cent  of  the  total  time 
interval.  The  difference  between  prestressing  at  point  A  and  prestressing 
at  point  B  may  be  reflected  as  a  difference  in  the  probabilities  of  failure 
during  the  last  25  per  cent  of  the  time  interval.  When,  using  the  method 
proposed  above,  it  is  assumed  that  no  change  in  failure  probabilities  occurs 
so  that,  basically,  it  is  assumed  that  prestressing  at  point  A  is  equivalent 
to  prestressing  at  point  B,  Such  an  assumption  would  appear  to  be  un¬ 
warranted  except  for  those  trajectories  that  coincide  with  the  contours  of 
the  stress-range  diagram.  To  be  conservative,  it  would  appear  necessary 
to  restrict  attention  to  those  trajectories  on  the  stress-range  diagram  that 
are  nearly  coincident  with  the  stress-range  contours. 

In  a  practical  application,  the  contours  of  the  stress -range  diagram 
will  not  be  represented  by  simple  contours,  but,  rather,  by  "confidence 
bands".  The  widths  of  the  confidence  bands  will  depend  on  the  variability 
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of  the  test  results  and  on  the  number  of  models  tested.  Thus,  in  practice, 
it  would  appear  that  attention  should  be  restricted  to  those  trajectories  that 
fall  within  a  confidence  band  associated  with  a  stress-range  contour. 

A  second  assumption  involved  in  the  preceding  development  is  this:  It 
is  assumed  that  the  probability  of  failure  associated  with  a  trajectory  di¬ 
rected  from  A  to  B  is  the  same  as  that  for  a  trajectory  directed  from  B  to  A, 
whenever  corresponding  segments  of  the  path  are  traversed  in  equal  time 
intervals.  As  an  illustration,  it  is  assumed  that  prestressing  at  a  point  A 
for  75  per  cent  of  the  total  time  followed  by  the  environmental  stress  con¬ 
dition  at  point  B  for  25  per  cent  of  the  time  yields  the  same  failure  prob¬ 
ability  as  pre stressing  at  B  for  25  per  cent  of  the  time  followed  by  the  en¬ 
vironmental  stress  at  point  A  for  the  remaining  75  per  cent  of  the  time.  It 
would  appear  difficult  to  assess  the  validity  of  this  assumption  without 
empirical  data. 


Use  of  Practical  Bounds  to  Determine 
Limits  on  Trajectory  Diagrams 

As  a  final  generalization,  suppose  that  the  plots  of  fi  and  0^  appear  as 
shown  in  Figure  20.  The  diagram  on  the  left  indicates  that  the  proportion 
of  the  total  stress  that  is  periodic  varies  between  10  and  40  per  cent;  the 
diagram  on  the  right  indicates  that  the  generalized  alternating  stress  varies 
between  40  and  60  per  cent  of  the  total  generalized  stress.  By  combining 
the  upper  and  lower  values  of  fj.  with  each  value  of  o^,  the  coordinates  of  the 
points  A,  B,  C,  D  on  the  stress -range  diagram  may  be  obtained.  For  the 
numerical  values  shown  on  Figure  20,  it  follows  that  the  coordinates  of  these 
points  are  given  by  the  table: 


P: 

(aM> 

cta) 

A: 

(5.4, 

0.6) 

B: 

(3.6, 

0.4) 

C: 

(0.9, 

0.6) 

D: 

(0.6, 

0.4) 

These  points  are  shown  on  the  trajectory  diagram  in  Figure  21. 
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crM  .Intrinsic  Generalized  Nonperiodic  Stress 

A-30099 


FIGURE  21.  BOUNDS  FOR  TIME  TRAJECTORIES  OF  A  SYSTEM  WITH 
STRESSES  SHOWN  IN  FIGURE  20 


The  shaded  portion  of  Figure  21  represents  those  points  of  the  stress- 
range  diagram  that  are  consistent  with  the  bounds  imposed  by  the  plots  of 
fi  and  <7^.  It  is  clear  that  the  procedure  may  be  reversed,  so  that,  starting 
with  a  shaded  region  of  the  stress -range  diagram,  the  corresponding  bounds 
on  \x  and  aA  may  be  determined.  This  procedure  may  represent  a  useful 
application  of  the  stress -range  diagram.  A  shaded  region  may  be  selected 
that  has  associated  with  it  failure  probabilities  that  are  sufficiently  small 
for  the  application  involved.  The  corresponding  a ^  and  fi  will  then  furnish 
the  limits  for  the  generalized  periodic  and  nonperiodic  stresses  under  which 
the  component  should  be  operated. 

Other  applications  of  this  formulation  are  suggested  by  considering 
various  functional  forms  for  the  generalized  periodic  and  nonperiodic 
stresses.  For  example,  what  combinations  of  linearly  increasing  mean 
stress  and  exponentially  decreasing  periodic  stress  yield  the  largest  ex¬ 
pected  life?  For  a  prescribed  functional  form  of  the  generalized  mean 
stress,  what  should  be  the  form  of  the  generalized  alternating  stress  that 
yields  a  trajectory  having  a  constant  failure  probability?  Specific  examples 
of  this  type  can  be  easily  examined  by  using  the  preceding  methods  whenever 
a  practical  situation  requires  it. 
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CONCLUSIONS 


Basic  concepts  usually  associated  with  the  theory  of  models  can  be 
applied  to  the  prediction  of  catastrophic  failures  of  systems  that  are  highly 
reliable.  Paperwork  computations  of  the  reliability  of  such  systems  are 
often  unconvincing  when  made  without  benefit  of  actual  data.  Moreover, 
because  excessively  long  periods  of  actual  operation  are  required  to  obtain 
a  single  catastrophic  failure,  the  reliability  of  such  a  system  is  often  beyond 
direct  experimental  inquiry.  As  an  alternative  to  both  of  these  procedures, 
the  theory  of  models  furnishes  criteria  and  methods  suitable  for  the  rapid 
generation  of  experimental  data  that  may  be  used  to  predict  the  reliability 
of  reliable  systems.  Mathematical  criteria  developed  in  this  report  indi¬ 
cate  the  conditions  under  which  reliability  data  obtained  from  '•accelerated" 
tests  can  be  used  to  predict  reliability  under  "normal"  use. 

The  simple  model -prototype  relation  developed  is  suitable  for  appli¬ 
cation  to  accelerated  test  programs  when  environmental  stresses  are 
negligible.  The  proposed  experimental  procedure  involves  a  set  of 
"accelerated  models"  that  are  tested  under  high  "abuse  ratios"  until  one 
catastrophic  failure  occurs.  The  equations  and  methods  required  to  use 
this  information  to  predict  the  probability  of  failure  of  the  prototype,  which 
operates  under  normal  use,  make  use  of  both  nonparametric  statistical 
methods  and  the  assumption  of  an  exponential  distribution  of  failure  times. 
The  equations  derived  may  be  used  to  determine  the  maximum  possible 
"acceleration"  for  the  models  and  the  probability  of  failure  under  normal 
use  for  various  operating  times  at  various  confidence  levels. 

Because  the  primary  concern  in  the  prediction  of  catastrophic  failures 
is  with  the  size  of  the  "tail"  that  contains  early  failures,  it  is  concluded  that 
"mean  life"  requirements  are  not  appropriately  applied  to  the  catastrophic 
reliability  of  highly  reliable  systems.  Instead,  it  is  proposed  that  a  catas¬ 
trophic  reliability  requirement  should  take  a  form  similar  to  the  following: 
"It  must  be  demonstrated  with  90  per  cent  confidence  that  the  probability  is 
0.  05  that  the  system  will  suffer  a  catastrophic  failure  within  10^  operating 
hours  under  normal  use."  The  methods  derived  yield  conclusions  of  this 
form  even  though  the  distribution  of  failure  times  and  the  associated  mean 
life  are  unknown. 

The  general  model -prototype  relation  that  is  presented  considers  the 
case  in  which  the  total  generalized  stress  on  the  system  consists  of  a 
periodic  and  a  nonperiodic  component.  The  graphical  method  of  analysis 
proposed  is  analogous  to  the  "stress -range  diagram"  usually  associated 
with  metal -fatigue  studies.  The  principal  use  of  this  method  may  be  the 
determination  of  bounds  within  which  a  system  is  required  to  operate  in 
order  to  meet  specific  reliability  requirements. 
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Finally,  it  is  concluded  that  the  theory  of  models  furnishes  a  highly 
flexible  and  singularly  appropriate  framework  for  the  development  of 
quantitative  criteria  and  methods  suitable  for  a  wide  variety  of  reliability 
problems.  It  is  believed  that  the  results  obtained  in  this  report  demon¬ 
strate  that  continued  efforts  involving  model-theoretic  approaches  to  re¬ 
liability  are  justified. 
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FIELD -DATA-COLLECTION  PROGRAM 


Effective  use  of  the  quantitative  statements  of  reliability  requires 
reasonably  accurate  data  on  a  large  number  of  variables  present  in  the 
operational  environment.  What  is  needed  is  a  continuous  history  of  the 
use,  failure,  and  repair  of  a  defined  set  of  propeller  controls  in  the  con¬ 
text  of  the  actual  operational  environment.  Existing  methods  for  collecting 
these  types  of  data  on  operations  and  maintenance  in  the  USAF  provide  in¬ 
formation  primarily  for  control  of  operations  and  maintenance  and  for 
estimating  the  kind  and  number  of  replacement  parts  needed  in  the  inven¬ 
tory.  As  a  part  of  the  research  under  this  contract,  a  field -data-collection 
program  was  designed  and  implemented  to  provide  as  much  information  as 
possible  on  the  operational  environment  of  turboprop  propeller  controls  in 
service. 

Methods  and  products  of  data-collection  processes  now  existing  in  the 
USAF  were  examined  to  determine  their  usefulness  for  estimating  reliabil¬ 
ity.  This  was  done  through  discussions  with  key  personnel  at  all  levels  of 
USAF  maintenance  activity.  It  was  concluded  that  certain  essential  data  re¬ 
quired  to  define  reliability  relations  were  not  collected  in  the  normal  rou¬ 
tine.  These  include  precise  identification  and  operating  history  of  a  failed 
part,  the  population  of  such  parts  operating  in  a  given  time,  and  the  esti¬ 
mated  cause  and  observed  effect  of  any  given  malfunction.  Because  it  is 
desirable  to  minimize  interference  with  routine  operations,  the  data- 
collection  plan  was  designed  to  use  existing  procedures  wherever  possible 
with  only  minor  modifications,  and  to  minimize  the  effort  of  USAF  personnel. 


Data -Collection  Plan 


Only  limited  numbers  of  turboprop  aircraft  have  reached  operational 
status  in  the  USAF,  primarily  in  the  support  wings  of  the  Tactical  Air 
Command.  This  fact  limited  the  choice  and  location  of  equipment  to  be 
studied.  The  Operational  Wing  selected  for  study  possessed  51  turboprop 
aircraft,  equally  distributed  among  three  squadrons.  In  August,  1957,  the 
Wing  was  preparing  to  convert  its  organization  to  the  consolidated  mainte¬ 
nance  management  operation  set  forth  in  TACM  66-1,  dated  July,  1957.  This 
form  of  maintenance  organization  simplifies  the  process  of  collecting  fail¬ 
ure  data  at  a  central  point.  Since  there  were  a  large  number  of  low -time 
aircraft,  a  data-collection  program  for  this  Wing  offered  an  opportunity  to 
monitor  reliability  growth  or  deterioration  throughout  most  of  the  contem¬ 
porary  life  history  of  the  propeller  controls.  Personnel  in  the  operating 
units  were  most  helpful  in  the  decision  to  establish  the  data-collection  pro¬ 
gram  at  this  Base. 
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Reporting  Media 


Organization  of  a  data-collection  program  depends  on  what  data  are  to 
be  collected  and  how  and  in  what  form  they  are  to  be  reported.  Examination 
of  the  existing  information  channels  revealed  that  DD  Form  781-2,  Aircraft 
Inspection  and  Maintenance  Record,  could  provide  valuable  information  with 
only  slight  modification  in  reporting  procedure.  This  daily  record  indicates 
aircraft  status,  flying  hours,  and  most  maintenance  actions  taken  on  a  spe¬ 
cific  aircraft,  A  simple  modification  in  the  reporting  process  was  made  by 
requesting  the  propeller  specialist  to  make  a  separate  entry  for  each  pro¬ 
peller  maintenance  action  accomplished.  Each  propeller  specialist  was 
provided  with  a  set  of  rubber  stamps  detailing  the  information  desired.  The 
use  of  these  rubber  stamps  would  standardize  the  data  entry  and  minimize 
the  writing  required.  An  instruction  sheet,  shown  in  Figure  22  was  given 
to  each  propeller  specialist  as  a  guide  in  reporting  each  propeller  mainte¬ 
nance  action  accomplished. 

The  DD  Form  781-2  contains  a  record  of  most  maintenance  actions 
performed  during  the  normal  working  period.  As  a  supplement  to  this,  it 
was  necessary  to  review  the  AFTO  Form  26' s  that  are  used  to  record  main¬ 
tenance  actions  during  periodic  inspections. 

In  routine  operational  flying,  detailed  descriptions  of  the  flight  oper¬ 
ating  conditions  at  the  time  a  malfunction  occurs  are  seldom  recorded  in 
permanent  form.  Knowledge  of  flight  conditions  and  operating  conditions 
at  the  time  of  malfunction  could  have  a  strong  bearing  on  reliability  esti¬ 
mates.  The  effect  of  the  malfunction  on  the  performance  of  the  assigned 
mission  is  particularly  important  in  evaluating  the  effect  of  reliability  on 
operations.  In  the  absence  of  standard  procedures  for  collecting  such  in¬ 
formation,  a  special  form,  Aircraft  Propeller  Malfunction  Record,  shown 
in  Figure  23,  was  prepared  for  use  in  this  program.  The  Aircraft  Pro¬ 
peller  Malfunction  Record  is  not  a  standard  USAF  form.  For  this  reason, 
it  was  necessary  to  obtain  specific  approval  for  its  use  from  the  Air  Mate¬ 
rial  Command.  Instructions  for  completing  the  special  form  were  provided 
as  shown  in  Figure  24.  Flight  technicians  or  flight  engineers  were  in¬ 
structed  to  complete  this  form  for  each  propeller  malfunction  experienced 
whenever  the  propeller  was  operating  in  flight  or  on  the  ground.  This  re¬ 
cord  could  then  be  correlated  with  subsequent  maintenance  actions  indicated 
on  the  DD  Form  781-2. 

In  addition  to  the  data  discussed  above,  several  corollary  items  of 
information  were  collected.  A  monthly  summary  was  made  showing  the 
total  propeller  maintenance  work  load  in  the  consolidated  Wing  maintenance 
organization  and  a  subtotal  showing  the  maintenance  work  load  on  the  vari¬ 
ous  maintenance  actions  performed  at  the  Base  level.  A  study  was  also 
made  of  the  propeller-control  overhaul  procedure  at  the  cognizant  Depot. 
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FIGURE  24.  INSTRUCTIONS  FOR  COMPLETING  SPECIAL  FORM, 
AIRCRAFT  PROPELLER  MALFUNCTION  RECORD 


The  Aircraft  Propeller  Malfunction  Record  is  designed  to  obtain  data  needed  by 
the  Air  Force  about  the  operational  environment  of  propeller  controls  in  turboprop  air¬ 
craft.  This  is  an  important  part  of  a  research  program  for  the  Propulsion  Laboratory, 
Wright  Air  Development  Center,  Wright-Patterson  Air  Force  Base,  Ohio. 

The  objective  of  this  special  data -collection  program  is  to  provide  information 
about  propeller  malfunctions  and  the  environment  in  which  they  occur.  The  ultimate 
aim  of  the  research  program  is  to  provide  guidance  for  future  efforts  to  attain  and 
maintain  propeller  control  reliability.  Everyone  working  with  tuiboprop  aircraft  and 
propeller  controls  will  realize  some  benefit  if  it  is  possible  to  reduce  accidents  and  in¬ 
cidents  involving  propeller  control  malfunctions  and  reduce  the  maintenance  work  load 
caused  by  an  excessive  number  of  malfunctions. 

The  information  requested  on  this  special  form  is  important  in  studying  the  en¬ 
vironment  when  malfunctions  occur.  Because  such  information  is  rarely  recorded  in 
readily  useful  form,  the  Aircraft  Propeller  Malfunction  Record  is  provided  for  this 
purpose, 

REPORTING  PROCEDURE 


Entries  on  this  form  are  self-explanatory,  with  the 
following  exceptions: 

Item  3  -  Mission  Symbol  Assigned  This  Flight.  Enter  appropriate  symbol  designated 
on  DD  Form  781-7. 

Item  6  -  Altitude  and  Indicated  Air  Speed.  Enter  the  approximate  altitude  to  the  near¬ 
est  1,000  feet  observed  at  the  time  of  the  malfunction.  Enter  the  approximate 
indicated  air  speed  to  the  nearest  25  knots  per  hour  observed  at  the  time  of 
the  malfunction. 

Item  7  -  Free  Air  Temperature  and  Other.  Enter  the  free  air  temperature  to  the 
.  nearest  10  degrees  observed  at  the  time  of  the  malfunction.  For  "Other” 
enter  any  other  climatic  influences  observed  at  the  time  of  the  malfunction 
such  as  heavy  icing,  severe  winds,  etc. 

Item  9  -  Turbine  Inlet  Temperature,  Propeller  RPM,  and  Engine  Torque.  Enter  the 
data  observed  at  the  time  of  the  malfunction  in  the  spaces  for  appropriate 
engines  and  indicate  the  extreme  values  observed  for  the  malfunctioning 
engine . 

Item  10  -  Propeller  Feathering  Time  Prior  to  Malfunction.  Enter,  in  the  spaces  for 
the  appropriate  engines,  the  number  of  times  each  propeller  was  feathered 
and  the  approximate  total  time  feathered  (in  minutes)  for  this  flight  prior 
to  the  occurrence  of  the  malfunction. 
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Data-Collection  Process 


The  collection  of  data  utilized  a  routine  flow  of  information,  as  shown 
in  Figure  25.  The  DD  Forms  781-2  were  sent  daily  from  the  Squadron 
maintenance  officer  to  the  Records  Section.  Because  these  forms  must  be 
on  file  in  the  Record  Section  for  a  6-month  period,  it  was  necessary  to  re¬ 
produce  the  entire  form  in  order  to  obtain  the  pertinent  information  for  the 
data-collection  program.  Likewise,  the  AFTO  Forms  26  containing  pro¬ 
peller  entries  were  reproduced  for  the  record.  Reproduction  of  these  forms 
was  accomplished  by  a  Battelle  representative  during  the  semimonthly 
visits.  Because  the  Aircraft  Propeller  Malfunction  Record  also  originated 
at  the  Squadron  level,  the  completed  forms  were  attached  to  the  DD  Forms 
781-2  and  were  collected  in  the  Record  Section. 

The  field-data-collection  program  was  conducted  during  the  period 
January  to  September,  1958.  Additional  data  were  obtained  on  malfunctions 
and  operation  of  the  turboprop  aircraft  prior  to  January,  1958,  by  reviewing 
the  standard  Air  Force  forms  such  as  the  DD  Forms  781-2  and  the  AFTO 
Form  26.  The  pertinent  forms  of  interest  for  the  reliability  study  were 
available  for  the  entire  period  beginning  in  May,  1957,  when  the  turboprop 
aircraft  were  put  in  operation.  Including  the  period  prior  to  January,  1958, 
the  data-collection  program  covered  688  aircraft  months  and  a  total  of 
86,000  propeller  flying  hours,  Battelle  personnel  made  frequent  visits  to 
the  Base  to  monitor  the  program.  During  these  visits,  meetings  were  held 
with  the  Base  personnel  participating  in  the  data  collection  to  exchange 
information  of  interest  and  to  encourage  continuation  of  the  always  excellent 
cooperation.  During  the  9 -month  program,  Battelle  personnel  made  a  total 
of  15  visits  for  periods  of  from  2  to  5  days  each. 

In  a  few  cases,  the  pertinent  Air  Force  forms  were  not  available  after 
June,  1958.  This  was  because  the  aircraft  were  assigned  temporarily  to 
other  bases,  and  the  DD  Forms  781-2  remain  with  the  aircraft  during  the 
period  away  from  the  home  Base.  At  the  close  of  the  field-data-collection 
program,  approximately  half  of  the  original  51  aircraft  included  in  the  data- 
collection  program  were  assigned  to  temporary  duty.  This  is  equivalent  to 
a  total  of  54  aircraft  months  of  operational  data,  and  these  data  are  not  in¬ 
cluded  in  the  analysis. 

During  the  early  phases  of  the  field-data-collection  program,  an  ac¬ 
ceptable  amount  of  data  was  obtained  through  the  cooperation  of  the  Base 
personnel,  particularly  on  the  special  form.  Aircraft  Propeller  Malfunction 
Record.  At  the  end  of  May,  1958,  however,  operational  conditions  were 
affected  by  the  world  situation  and  a  number  of  the  aircraft  were  assigned 
to  temporary  duty  off  Base.  The  reporting  of  special  data  on  operating 
conditions  at  the  time  of  malfunction  and  special  entries  on  DD  Form  781-2 
were  essentially  brought  to  a  halt.  Many  of  the  Base  personnel  were  placed 
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FIGURE  25.  DATA  COLLECTION  PROCESS 
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on  alert  or  were  being  transferred;  those  remaining  were  assigned  extra 
duty.  Efforts  by  the  Battelle  personnel  to  revive  interest  in  the  program 
and  assure  accurate  reporting  after  June,  1958,  were  not  successful. 


Special  Data  Entries 


One  part  of  the  special  data  collection  was  carried  out  by  the  propeller 
specialists.  They  were  requested  to  make  a  special  entry  on  the  back  of  the 
DD  Forms  781-2.  As  an  aid,  the  propeller  specialists  were  provided  rub¬ 
ber  stamps  outlining  the  information  desired  and  minimizing  the  writing  re¬ 
quired.  The  main  purpose  of  the  rubber-stamp  entry  was  to  provide  infor¬ 
mation  pertaining  to  the  cause  of  a  particular  malfunction  since  this 
information  is  not  available  on  the  standard  Air  Force  forms. 

The  propeller  specialists  at  the  Base  level  are  more  or  less  limited 
to  adjustment,  servicing,  or  the  removal  and  replacement  of  the  propeller 
assemblies,  rather  than  repair  of  these  assemblies.  This  limits  their  ability 
to  find  and  report  a  cause  for  a  particular  malfunction.  For  example,  pro¬ 
peller  specialists  are  not  allowed  to  dismantle  a  regulator,  one  of  the  major 
assemblies  in  the  propeller -control  system.  Table  4  provides  an  indication 
cf  the  limited  work  the  propeller  specialists  perform  at  the  Base  level. 

TABLE  4.  TASKS  AND  JOB  STANDARDS 
(Prepared  by  Standardization  Section) 


Job  Nomenclature 

Remove  and  Replace 

Adjust  or  Repair 

(1) 

Strobe -run 

N/A 

3  man-hours  (2  men) 

(2) 

Gray  box  (circuit  tester) 

N/A 

2  man-hours  (2  men) 

(3) 

Propeller 

10  man-hours  (2  men) 

1  man-hour  (1-2  men) 

(4) 

Regulator 

4  man-hours  (2  men) 

N/A 

(5) 

Reservoir 

1  man-hour  (1  man) 

N/A 

(6) 

Spinner 

10  man-hours  (2  men) 

2  man-hour 8  (1  man) 

(7) 

ATE 

1  man-hour  (1  man) 

4  man-hours  (1  man) 

(8) 

Alternator 

1  man-hour  (1  man) 

N/A 

In  many  cases  the  normal  entry  made  by  the  propeller  specialists  on 
the  DD  Form  781-2  contained  all  the  information  they  could  provide,  par¬ 
ticularly  in  cases  where  they  were  unable  to  give  the  estimated  cause  of  the 
malfunction.  In  a  few  cases,  the  propeller  specialists  were  able  to  give  the 
true  cause  of  a  malfunction.  These  few  data  were  not  sufficient  for  analysis 
in  any  detail. 
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Aircraft  Propeller  Malfunction  Record 


The  purpose  of  the  Aircraft  Propeller  Malfunction  Record  was  to 
obtain  data  on  the  flight  and  operating  conditions  at  the  time  of  a  malfunc¬ 
tion.  This  special  form  was  particularly  successful  during  the  early  phases 
of  the  data -collection  program.  In  the  period  from  January  through  May, 
1958,  an  estimated  one-third  to  one -half  of  the  malfunctions  were  reported 
on  the  special  form.  After  that  period,  only  a  few  of  the  special  forms 
were  received  each  month.  In  general,  the  special  forms  that  were  re¬ 
ceived  were  completed  satisfactorily.  Because  of  the  high  inherent  reli¬ 
ability  of  the  propeller-control  system  and  the  difficulties  encountered  after 
May,  1958,  the  number  of  special  forms  received  was  not  sufficient  to  allow 
an  analysis  to  be  made. 


Depot  Information 

Knowledge  of  the  Depot  overhaul  procedure  would  complete  the  history 
of  the  operational  cycle  of  the  propeller  controls.  It  was  concluded  that 
this  information  would  have  to  be  taken  from  pertinent  Technical  Orders, 
Time  Compliance  Technical  Orders,  and  Maintenance  Engineering  Orders 
covering  overhaul  of  the  propeller  assemblies  at  the  Depot.  Plans  were 
made  to  receive  copies  of  these  publications  from  the  Depot  at  monthly  in¬ 
tervals.  It  was  learned  late  in  the  program  that  this  information  would  not 
have  been  necessary,  since  only  a  few  of  the  propeller  assemblies  had  been 
sent  to  the  Depot  for  overhaul.  Most  of  the  propellers  included  in  the  data- 
collection  program  had  not  yet  reached  the  mandatory  overhaul  time  of 
600  hours.  In  October,  1957,  this  time  was  extended  to  900  hours. 


Results 


The  propeller  and  its  control  mechanism  on  the  whole  are  exhibiting 
high  reliability  under  the  prevailing  operating  conditions.  Two  factors  per¬ 
taining  to  propeller -control  reliability  are  quite  evident.  First,  the 
propeller -control  malfunctions  account  for  over  90  per  cent  of  the  total 
propeller  malfunctions.  The  integrity  of  structural  members,  the  blades, 
gears,  shafts,  etc.  ,  is  good,  with  the  result  that  the  malfunctions  that  do 
occur  are  primarily  associated  with  elements  of  the  control  mechanism,  the 
"brains"  rather  than  the  "muscles".  However,  there  is  no  certainty  that 
recent  design  changes  in  the  blade  and  gearing  components  to  reduce  rpm 
and  cabin  vibration  will  not  influence  the  structural  reliability.  Further  ob¬ 
servation  would  be  necessary  to  evaluate  the  effect  of  such  changes  on  oper¬ 
ational  reliability.  Secondly,  the  propeller  repair  workload  is  a  rather 
small  fraction  of  total  aircraft  maintenance  workload.  Considering  the 
limited  scope  of  the  propeller  repair  activity  shown  in  Table  4,  a  twofold 
increase  in  propeller  malfunction  rate  or  repair  man-hours  per  malfunction 
would  not  significantly  affect  the  operational  reliability  attainable. 
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Figures  26  through  35  contain  a  graphical  summary  of  the  operational 
data  on  the  turboprop  aircraft  operation  from  the  period  May,  1957,  to 
September,  1958.  Included  in  this  material  are  (1)  the  removal  and  re¬ 
placement  of  the  propeller  assemblies  and  components,  (2)  malfunctions  of 
the  propeller  assemblies  and  components,  (3)  the  maintenance  workload,  and 
(4)  the  flying  load.  In  studying  these  graphs,  it  should  be  remembered  that 
the  number  of  aircraft  operating  in  the  period  June  to  September,  1958, 
was  considerably  smaller  than  the  original  population  of  51  aircraft. 

Figure  26  shows  the  premature  removal  rate  per  thousand  propeller 
hours  flown  for  propeller  assemblies,  regulators,  ATE's,  and  alternators. 
Two  other  propeller  assemblies,  the  spinner  and  the  reservoir,  that  ex¬ 
perienced  premature  removals  during  the  data-collection  program  are  not 
included  because  the  total  number  removed  was  very  small. 

By  using  information  obtained  on  the  rubber-stamp  entry  on  DD  Forms 
781-2  and  also  the  Forms  26E,  the  history  of  the  propeller  assemblies 
after  first  removal  was  determined.  Figure  27  shows  that  the  lag  time  be¬ 
tween  removal  and  installation  on  another  aircraft  experienced  by  the  major¬ 
ity  of  propeller  assemblies  was  less  than  2  to  3  weeks.  This  bears  out  the 
fact  that  maintenance  action  on  these  assemblies  was  done  at  the  Base  level, 
rather  than  the  Depot  level.  Depot  repair  or  overhaul  of  a  propeller  as¬ 
sembly  would  normally  require  a  period  of  6  to  8  weeks;  however,  only  a 
few  propeller  assemblies  had  been  sent  to  the  Depot  for  overhaul.  This 
verifies  the  lag -time  chart  on  Figure  27. 

Figure  28  indicates  the  distribution  of  the  malfunctions  experienced 
on  the  propeller.  All  control  malfunctions  were  recorded  under  the  propel¬ 
ler  assembly,  and  also  under  the  particular  subassembly  that  malfunctioned. 
"Other  Control",  as  used  in  the  figure,  includes  the  control  malfunctions 
that  were  not  attributed  to  a  particular  assembly.  "Other",  as  used  in  the 
figure,  includes  propeller  malfunctions  not  related  to  control. 

Figure  29  shows  the  total  propeller  malfunctions  per  month  and  the 
propeller  malfunctions  per  thousand  propeller  hours  reported  on  the  DD 
Forms  781-2.  It  is  noted  that  the  exceptionally  high  malfunction  rate  dur¬ 
ing  October,  1957,  and  August,  1958,  rises  in  the  same  manner  as  the 
premature  removal  rate  for  the  ATE 's,  propeller  assemblies,  and  regu¬ 
lators,  respectively,  as  shown  on  Figure  26. 

Figure  30  shows  the  total  aircraft  maintenance  man-hours  recorded 
on  the  DD  Form  781-2  and  also  the  total  propeller  maintenance  man-hours 
expended  per  calendar  month.  The  total  number  of  man-hours  expended  on 
propellers  was  obtained  through  the  cooperation  of  the  Wing  personnel  in  the 
Reports  and  Analysis  Section.  The  man-hour  figure  includes  all  of  the  mis¬ 
cellaneous  work  done  by  the  propeller  personnel  during  their  normal  work 
day.  An  average  of  85  per  cent  of  the  man-hours  expended  in  the  propeller 
section  is  carried  out  on  miscellaneous  work.  The  other  15  per  cent  is 
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FIGURE  26.  PREMATURE  REMOVAL  RATE  FOR  THE  PROPELLER 
ASSEMBLY,  THE  REGULATOR  ASSEMBLY,  THE 
ELECTRONIC  GOVERNOR  (ATE),  AND  THE 
ALTERNATOR 
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FIGURE  30.  PROPELLER  AND  AIRCRAFT  MAINTENANCE  MAN-HOURS  EXPENDED  ON 
THE  TURBOPROP  AIRCRAFT 
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expended  on  jobs  as  listed  in  Table  4.  The  DD  Forms  781-2  contain  only  a 
record  of  the  work  done  as  contained  in  the  job  standards,  plus  propeller 
servicing.  Consequently,  the  total  number  of  propeller  man-hours  re¬ 
corded  on  the  DD  Forms  781-2,  as  presented  graphically  on  Figure  31, 
represents  approximately  15  per  cent  of  the  total  man-hours  expended  by 
propeller  maintenance  personnel. 

The  propeller  maintenance  actions  reported  on  the  DD  Forms  781-2 
were  tabulated  according  to  the  time  required  to  perform  the  particular 
action.  It  was  found  that  approximately  1/3  of  the  actions  required  1  man¬ 
hour  or  less,  6/10  required  2  man-hours  or  less,  and  8/10  required  4  man¬ 
hours  or  less.  This  indicates  that  most  of  the  malfunctions  experienced 
with  the  propeller  are  minor  and  require  a  minimum  amount  of  maintenance 
action. 

Figure  32  shows  graphically  the  history  of  the  maintenance  man-hours 
per  flying  hour  for  the  period  of  the  data -collection  program.  Total  main¬ 
tenance  man-hours  was  taken  from  the  DD  Forms  781-2  but  the  propeller 
maintenance  man-hours,  which  include  the  miscellaneous  man-hours  ex¬ 
pended  on  the  props,  were  received  from  the  personnel  in  the  Reports  and 
Analysis  Section. 

Figure  33  shows  the  history  of  the  aircraft  flying  hours  per  month 
and  also  the  total  number  of  flights  per  month.  The  average  flight  for  the 
period  studied  was  approximately  2.  68  hours.  The  decline  in  both  aircraft 
hours  and  number  of  flights  recorded  after  June,  1958,  is  experienced  as  a 
result  of  the  assignment  of  many  of  the  aircraft  to  temporary  duty,  with 
subsequent  absence  of  DD  Form  781-2  as  a  source  of  data.  A  more  accu¬ 
rate  indication  of  the  aircraft  flying  rate  is  shown  on  Figure  34,  which  is  a 
record  of  the  total  flying  hours  per  aircraft  flying.  It  will  be  noted  that  the 
trend  in  average  number  of  flying  hours  per  month  per  aircraft  is  upward 
until  a  level  of  approximately  40  hours  per  month  per  aircraft  is  reached. 
This  corresponds  to  average  experience  for  transport-type  aircraft  units 
maintaining  70  per  cent  availability  and  8  per  cent  utilization  rates. 

Personnel  in  the  Report  and  Analysis  Section  also  provided  a  record 
of  the  rate  of  Aircraft  Out  of  Commission  for  Parts,  This  was  calculated 
monthly  by  dividing  the  total  number  of  AOCP  hours  by  the  number  of  as¬ 
signed  aircraft  hours.  This  is  shown  graphically  in  Figure  35. 


Analysis  of  Operational  Data 
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The  importance  of  complete  and  accurate  knowledge  of  operational 
conditions  in  the  environment  in  any  evaluation  of  operational  reliability 
is  evident  from  the  preceding  tables  and  graphs.  During  the  data- collection 
period  from  January  to  September,  1958,  operational  demand  in  terms  of 
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FIGURE  31.  PROPELLER  MAINTENANCE  MAN-HOURS  AS  RECORDED  ON  DD  FORMS  781- 
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FIGURE  33.  AIRCRAFT  FLYING  HOURS  AND  NUMBER  OF  FLIGHTS  DURING  THE 
DATA-COLLECTION  PROGRAM 
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FIGURE  35.  AIRCRAFT-OUT -OF-COMMISSION-FOR -PARTS  RATE  FOR  PART  OF  THE 
DATA-COLLECTION  PROGRAM 


aircraft  flying  hours  and  number  of  flights  varied  irregularly  from  a 
moderate  low  value  in  January  of  1360  hours  in  580  flights  to  a  peak  in 
May  of  nearly  2200  hours  in  900  flights.  The  abnormal  dropoff  in  August 
was  due  to  temporary  off-Base  assignment  of  aircraft  and  consequent  de¬ 
cline  in  the  number  of  aircraft  for  which  data  were  available. 

During  this  same  period,  AOCP  rate  dropped  from  22  per  cent  to 
below  10  per  cent.  Flying  hours  per  aircraft  flying  increased  unsteadily 
from  less  than  30  to  more  than  40  hours  per  month.  The  number  of  pro¬ 
peller  malfunctions  per  1000  hours  of  propeller  time  varied  from  5. 8  to 
a  high  of  9. 7  in  August.  At  the  same  time,  the  number  of  premature  re¬ 
movals  of  propeller  components  reflects  the  improvement  in  ATE  reliability 
early  in  the  period,  followed  later  in  the  period  by  a  deterioration  in  the 
regulators.  Despite  this  variation  in  operational  environment,  propeller 
maintenance  man-hours  expended  remained  at  less  than  20  per  cent  of  total 
aircraft  maintenance  man-hours  for  most  of  the  period.  From  the  opera¬ 
tional  simulation  presented  in  another  section  of  this  report,  it  appears  that 
the  number  of  propeller  maintenance  man-hours  available  would  have  been 
sufficient  to  sustain  an  order -of -magnitude  increase  in  propeller  malfunc¬ 
tion  rate  without  serious  degradation  of  operational  performance. 

An  accurate  picture  of  the  reliability  of  propellers  and  their  controls 
in  a  dynamic  operational  environment  can  be  obtained  by  determining  the 
values  of  reliability  parameters,  such  as  hazard  rate.  In  this  analysis, 
the  total  number  of  propeller  malfunctions  sustained  is  representative  of 
the  propeller  control  performance,  inasmuch  as  the  majority  of  such  mal¬ 
functions  were  those  having  to  do  with  control  elements. 

In  Table  5,  the  reliability  of  the  propellers  and  controls  is  shown  in 
terms  of  the  hazard  rate,  i.  e.  ,  the  probability  of  malfunction  in  the  next 
flying  hour  for  the  total  population.  It  must  be  recalled  that  the  hazard 
rate  is  defined  as  the  number  of  malfunctions  divided  by  the  number  of  ex¬ 
posure  hours  in  a  given  unit  of  time.  In  Table  5,  the  basic  100 -hour 
time  unit  is  obtained  by  dividing  the  propeller  population  into  100 -hour  age 
groups. 

The  hazard  rate  for  complex  equipment  is  generally  expected  to  re¬ 
main  fairly  constant  during  the  period  of  low-frequency  random  failures. 

The  propeller  control  observed  during  this  study  is  seen  to  exhibit  a  nearly 
constant  hazard  rate  throughout  the  first  400  hours  of  operation.  However, 
in  the  400 -to -500 -hour  age  group  the  probability  of  malfunction  increases 
rather  suddenly  by  nearly  a  factor  of  2.  This  is  a  strong  indication  that 
some  element  of  the  propeller  is  sustaining  a  wear -out  condition.  Since  the 
400-to-500-hour  propeller  age  group  does  not  correspond  to  any  particular 
calendar  time,  there  is  not  necessarily  any  direct  relationship  between  the 
observed  ATE  or  regulator  malfunctions  and  the  noted  increase  in  hazard 
rate. 
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(a)  Propellers  that  have  not  been  removed  for  malfunction  since  new, 

(b)  Incomplete  records. 

(c)  Propellers  that  have  been  removed  for  repair  and  reinstalled. 


The  total  population  of  propellers  contains  both  original  and  replace¬ 
ment  equipment.  It  was  suspected  that  these  two  distinct  groups  would  ex¬ 
hibit  different  malfunction  patterns,  and  this  is  indeed  evident.  In  Table  5, 
the  original  population  exhibits  a  reasonably  stable  hazard  rate  of  approxi¬ 
mately  0.  007  during  the  first  400  hours.  This  is  equivalent  to  one  failure 
or  malfunction  expected  for  each  143  hours  of  operation.  In  the  400 -to- 
500-hour  age  group,  hazard  rate  increases  to  nearly  0.014,  or  an  expect¬ 
ancy  of  one  failure  for  each  72  hours  of  operation. 

Replacement  propellers  exhibit  a  distinctly  different  pattern  of  mal¬ 
function.  In  the  first  200  hours  after  reinstallation,  the  replacement  pro¬ 
pellers  sustain  a  hazard  rate  of  approximately  0,01  equivalent  to  one  ex¬ 
pected  failure  in  each  100  hours.  Thus,  the  replacements  are  prone  to  fail 
at  least  once  shortly  after  installation.  Thereafter,  the  hazard  rate  de¬ 
clines  to  the  apparent  normal  average  rate  for  this  propeller  model. 

After  plotting  the  hazard  rate  of  malfunction  graphically  in  Figure  36 
for  the  original,  replacement,  and  over -all  population  of  propellers,  the 
apparent  incidence  of  malfunction  in  the  400 -to -500 -hour  bracket  is  at  once 
evident.  The  vertical  or  hazard  rate  scale  is  exaggerated  to  emphasize  the 
small  changes  in  hazard  rate.  At  the  average  flying  rate  of  40  hours  per 
month  or  less,  an  increase  of  100  hours  in  propeller  age  is  the  equivalent 
to  an  elapsed  time  of  more  than  2-1/2  months  of  operation. 

It  should  be  pointed  out  that  the  terms  "failure"  and  "malfunction"  are 
not  synonymous  in  the  case  of  propeller  controls.  The  term  "failure"  im¬ 
plies  that  some  element  of  the  system  must  be  replaced  in  order  to  resume 
normal  operation.  Well  over  half  of  the  propeller  troubles  constitute  mal¬ 
functions,  rather  than  failures,  because  the  repair  and  adjustment  involved 
does  not  require  replacement  of  parts. 

The  number  and  rate  of  premature  removals  of  propellers  in  the 
original  population  indicate  those  malfunctions  or  failures  that  could  not 
be  corrected  through  routine  repair  and  adjustment.  In  many  instances, 
parts  replacement  was  not  necessary.  The  removal  or  probability  of  sur¬ 
vival  per  hour  shows  an  upward  trend  to  the  peak  of  0,003  approximately  in 
the  400-to-500-hour  age  group,  equivalent  to  one  removal  expected  in  each 
340  hours  of  operation.  Removals  for  inspection  are  specifically  excluded 
from  this  calculation.  Accumulating  the  premature  removals  and  relating 
them  to  accumulative  aging  of  the  propeller  leads  to  an  estimate  of  the  sur¬ 
vival  rate  or  probability  of  survival  as  the  propeller  and  its  control  con¬ 
tinued  to  age.  In  Figure  37,  the  probability  of  survival,  St,  is  plotted 
against  time  for  the  observed  propeller  system.  Assuming  that  the  survival 
curve  takes  the  form  of  a  Poisson  distribution,  in  accordance  with  random 
failure  conditions,  the  cumulative  survival  rate  can  be  used  to  estimate  the 
half-life  or  two-thirds  life  of  the  equipment.  In  practice,  the  two-thirds 
life  is  often  equivalent  to  the  mandatory  overhaul  time.  In  Figure  37,  it  can 
be  seen  that  the  half-life  of  the  equipment  observed  is  approximately  700 
hours  and  the  two-thirds  life  is  approximately  1100  hours.  This  means  that 
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Hazard  Rate  (Probability  of  Malfunction  Per  Hour) 


Total  population 


FIGURE  36.  HAZARD  RATE  OF  MALFUNCTION  EXPERIENCED 
BY  PROPELLERS  AND  CONTROLS 
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FIGURE  37.  PROBABILITY  OF  SURVIVAL  DERIVED  FROM  FIELD  DATA 


at  the  700-hour  point  it  can  be  expected  that  half  of  the  present  original 
population  will  still  be  in  operation.  In  the  early  life  of  the  propeller  and 
its  control,  a  running  estimate  of  probability  of  survival  would  have  indi¬ 
cated  that  the  half-life  of  the  system  would  be  somewhere  between  1300  and 
1400  hours.  The  decline  of  between  200  and  500  hours  indicates  a  deterior¬ 
ation  in  the  reliability  of  the  system  during  this  particular  period  of  aging. 
This  is  not  unusual.  It  represents  the  more  or  less  typical  degradation  of 
reliability  of  complex  equipment  experienced  under  operational  conditions, 
as  contrasted  with  the  less  severe  and  less  variable  flight-test  environment, 
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APPENDIX  E 

COMPUTER  SIMULATION  AND  ANALYSIS  OF 
OPERATIONAL  RELIABILITY 


The  reliability  of  aircraft  and  their  components  under  operational  con¬ 
ditions  is  dependent  upon  a  great  many  factors  other  than  the  inherent  re¬ 
liability  of  the  equipment.  The  technical  definition  of  reliability  recognizes 
this  fact  when  it  states  that  reliability  is  a  function  of  assigned  task  and  en¬ 
vironment.  The  term  "as signed  task"  refers  to  frequency  and  duration  of 
flight  as  well  as  to  the  severity  of  use  relative  to  the  intended  purpose  of  the 
equipment.  The  term  "environment"  takes  into  account  the  immediate 
physical  environment  in  which  the  equipment  is  operating  and  includes  a 
great  many  other  factors  contributing  to  operational  success ,  such  as 
maintenance  availability  and  effectiveness  of  logistic  support. 

One  approach  to  evaluating  situations  containing  a  substantial  number 
of  stochastic  variables  is  to  simulate  the  interaction  of  these  variables  with 
a  computer.  There  are  some  advantages  and  some  disadvantages  to  this 
approach,  both  well  substantiated  in  the  literature  on  simulation.  Although 
its  limitations  are  recognized,  this  method  is  often,  as  in  this  case,  the 
only  one  that  permits  simultaneous  consideration  of  the  many  variables 
involved. 

Two  problems  were  simulated  during  this  study,  differing  in  point  of 
interest  and  in  degree  of  complexity.  The  first  simulation  was  undertaken 
to  observe  the  effects  of  several  variables  on  the  status  of  a  propeller  - 
control  population  as  that  population  aged  in  operational  use.  The  variables 
of  interest  included  the  aging  process,  hazard  rate,  type  of  repair  (field 
maintenance  or  overhaul),  and  fluctuation  in  number  of  mandatory  overhauls 
as  a  function  of  time. 

The  second  simulation  was  undertaken  to  determine  the  effects  of 
operational  flying  load,  hazard  rate,  malfunction  repair  requirements,  and 
maintenance  capability  on  the  operational  capability  of  a  defined  USAF  unit. 
The  basis  for  this  simulation  was  field  data  obtained  on  the  operations  of 
turboprop  aircraft  during  this  study.  One  objective  of  this  simulation  was 
to  show  the  relative  importance  of  propeller  malfunctions  as  they  affect  unit 
capability  in  comparison  with  other  events  occurring  in  the  general  situation. 
Another  objective  was  to  determine  the  relative  importance  of  malfunction 
rate  and  maintenance  repair  time  as  causative  factors  in  producing  pro¬ 
peller  maintenance  queues. 

The  starting  point  for  operational  analysis  is  to  determine  what  is 
meant  by  "operations".  In  this  study,  the  term  "operations"  is  represented 
by  the  generalized  flying  cycle  shown  in  Figure  38.  This  is  the  operational 
cycle  for  flying  equipment  of  flight  systems  at  the  unit  or  Base  level.  The 
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FIGURE  38.  A  GENERALIZED  FLYING  CYCLE 
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paths  in  Figure  38  indicate  the  movement  of  the  system  through  the  flying 
maintenance  cycle.  The  occurrence  of  a  malfunction  and  the  nature  of  that 
malfunction  determine  the  path  the  system  follows  through  the  cycle.  If  the 
hazard  rate  of  the  systems  in  operation  is  constant  (i.e.,  an  exponential 
failure  distribution) ,  then  the  expected  number  of  malfunctions  per  unit 
time  is  often  calculated  by  an  approximation  m  =  N(1  -  e-at),  where  N  is  the 
number  of  systems  flying  during  a  given  period  of  time,  a  is  the  hazard 
rate  or  the  probability  that  a  system  will  fail  in  an  increment  of  time  (i.  e.  ,  1 
hour),  and  t  is  the  expected  number  of  flying  hours  per  system  during  the 
given  period  of  time.  For  example,  if  100  propeller  controls  with  a  hazard 
rate  of  0.  01  in  the  next  hour  fly  an  average  of  4.0  hours  per  day,  the  ex¬ 
pected  number  of  malfunctions  by  this  method  of  calculation  would  be 
approximately  4.  If  the  hazard  rate  is  increased  to  0.1,  the  expected  num¬ 
ber  of  failures  increases  to  33. 

Although  this  seems  an  easy  method,  it  is  useful  only  if  the  many 
assumptions  upon  which  it  is  based  are  true.  For  example,  it  must  be 
assumed  that  all  systems  available  are,  in  fact,  operated  and  that  all  mal¬ 
functions  that  may  occur  have  an  equal  likelihood  of  occurrence.  Neither  of 
these  assumptions  can  be  justified  satisfactorily.  The  method  suffers  also 
from  the  use  of  expected  values  in  estimating  short-term  effects.  The  dis¬ 
persion  and  irregularity  in  the  frequency  of  malfunctions  is  a  major  factor 
in  determining  operational  capability.  Further,  this  method  says  nothing 
about  the  maintenance  capability  to  repair  these  malfunctions  or  the  in¬ 
fluence  of  assigned  mission  or  observed  hazard  rate  on  operations. 


The  First  Simulation 


A  population  of  400  new  assemblies  is  introduced  into  service  over  a 
period  of  months  at  a  prescribed  rate.  The  introduction  rate  need  not  be 
uniform,  but  may  vary  from  month  to  month.  There  is  a  fixed  utilization 
policy  for  flying -hour  rate  and  mandatory  overhaul.  The  nature  of  these 
assemblies  is  such  that,  if  they  are  inoperable,  the  aircraft  on  which  they 
are  mounted  cannot  operate.  The  following  assumptions  are  made  regarding 
the  operation: 


(1)  The  aging  process  or  accumulation  of  flying  hours  each 

month  among  the  assemblies  is  approximated  by  a  Poisson 
distribution: 


Hours  Per  Cent 

0-25  4.2 

25-50  15.5 

50-75  25.8 


Hours  Per  Cent 

75-100  25.8 
100-125  17.2 
125-250  8.1 


Hours  Per  Cent 

150-175  2.7 

175-200  0.6 

200-225  0.1 
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(2)  All  assemblies  have  an  equal  likelihood  of  flying  in  any 
increment  of  time. 

(3)  Repair  or  replacement  of  an  assembly  for  malfunction  or 
mandatory  overhaul  is  an  instantaneous  process  and 
AOCP  is  zero. 

(4)  In-service  inventory  remains  constant  during  each  monthly 
period  and  is  equal  to  the  cumulative  number  of  assemblies 
introduced,  excluding  spares. 

(5)  Failure  pattern  is  exponential  with  time,  and  hazard  rate 
remains  constant. 

With  these  simplifying  assumptions,  the  time  history  of  the  population  can 
be  constructed  by  means  of  a  computer  program  to  find  the  expected  number 
of  failures  and  removals  for  mandatory  overhaul  on  a  monthly  basis. 

The  results  of  several  cases  are  summarized  in  Table  6  and  are 
shown  graphically  in  Figure  39.  In  Case  I,  the  hazard  rate  (p£  =  0.  0005) 
and  constant  rate  of  introduction  into  service  permit  the  cycle  to  stabilize 
relatively  fast  at  a  ratio  of  expected  failures  to  expected  mandatory  over¬ 
hauls  of  about  1:5.  Cases  II  and  III,  where  pf  «  0,001,  result  in  a  ratio  of 
expected  failures  to  expected  mandatory  overhauls  at  about  1:2.  5  but  show 
no  significant  effect  from  the  fluctuating  introduction  rate  other  than  a  slight 
delay  in  reaching  stabilization.  It  must  be  remembered,  however,  that  the 
assumptions  are  such  that  the  stability  produced  is  somewhat  artificial,  and 
that  the  present  model  of  the  situation  needs  considerable  refinement.  To 
observe  the  effect  of  an  increasing  mandatory  overhaul  time.  Case  IV  per¬ 
mits  the  original  300-hour  limit  to  double  after  6  months  of  operation.  This 
change  in  operating  conditions  further  extends  the  settling  time  and  brings 
about  a  1:1  ratio  between  expected  failures  and  expected  mandatory  over¬ 
hauls.  The  last  set  of  conditions,  Case  V,  raises  the  hazard  rate  by  an 
order  of  magnitude  to  p^  =  0.  01.  This  condition  is  sufficiently  severe  so 
that  the  flying -hour  rate  has  to  be  reduced.  The  34:1  ratio  of  expected 
failures  to  expected  mandatory  overhauls  shows  that  few  assemblies  survive 
to  mandatory  overhaul  under  this  set  of  conditions. 

Referring  again  to  Figure  38,  it  is  obvious  that  the  number  of 
assemblies  sent  to  the  overhaul  Depot  depends  upon  the  fraction  of  failures 
repairable  by  the  operating  unit  and  is  the  sum  of  the  nonrepair  able  failures 
and  the  removals  for  mandatory  overhaul.  On-Base  repair  capabilities 
depend  upon  the  nature  and  severity  of  the  failure  and  the  support  equipment 
available.  The  number  of  spare  assemblies  (N)  required  to  replace  those 
that  fail  (F)  or  are  removed  for  overhaul  (O)  is  linearly  related  to  the 
elapsed  time  in  months  in  the  overhaul  pipeline  (M)  and  can  be  written  as 

N  =  -M.  [o  +  (1-a)  F],  where  O  and  F  are  stochastic  variables  and  a  is  the 

fraction  of  failures  repaired  on  the  Base. 
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FIGURE  39.  MANDATORY  OVERHAULS  PER  MONTH  FOR  400  ASSEMBLIES  UNDER  SEVERAL 
ASSUMED  OPERATING  CONDITIONS 


TABLE  6, 


SUMMARY  OF  MONTHLY  FAILURES  AND  MANDATORY  OVERHAULS 


Case  I 

Case  II 

Mandatory  Overhaul,  hours: 

300 

300 

Rate  of  Introduction  Into  Service  Per  Month: 

100 

100 

Hazard  Rate,  pj: 

0.0005 

0.001 

Average  Flying-Hour  Rate,  hours  per  month: 

81.25 

81.25 

Mandatory 

Mandatory 

Month 

Failures 

Overhauls 

Total 

Failures 

Overhauls 

Total 

1 

4.0 

0.0 

4.0 

8.0 

0.0 

8.0 

2 

8.1 

0.3 

8.4 

16.1 

0.3 

16.4 

3 

12.1 

9.5 

21.6 

24.1 

9.2 

33.3 

4 

16.2 

39.5 

55.7 

32.1 

37.1 

69.2 

5 

16.2 

69.3 

85.5 

32.1 

63.5 

95.6 

6 

16.2 

86.7 

102.9 

32.1 

79.1 

111.2 

7 

16.2 

93.4 

109.6 

32.1 

85.8 

117.9 

8 

16.2 

85.4 

101.6 

32.1 

78.5 

110.6 

9 

16.2 

79.6 

95.8 

32.1 

73.7 

105.8 

10 

16.2 

83.2 

99.4 

32.1 

76.9 

109.0 

11 

16.2 

86.8 

103.0 

32.1 

79.7 

111.8 

12 

16.2 

85.6 

101.8 

32.1 

78.5 

110.6 

13 

16.2 

83.4 

99.6 

32.1 

76.9 

109.0 

14 

16.2 

83.7 

99.9 

32.1 

77.3 

109.4 

15 

16.2 

84.9 

101.1 

32.1 

78.1 

110.2 

16 

17 

13 

19 

20 
21 
22 

23 

24 

25 

26 
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FOR  400  ASSEMBLIES  UNDER  SEVERAL  ASSUMED  OPERATING  CONDITIONS 


Case  111 

Case  IV 

Case  V 

300 

300  for  6  months,  then  600 

300 

50-150- 

-50-150  over  4  months 

100 

100 

0.001 

0.001 

0.01 

81.25 

83.25 

40.0 

Mandatory 

Mandatory 

Mandatory 

Failures 

Overhauls 

Total 

Failures 

Overhauls 

Total 

Failures 

Overhauls 

Total 

4.0 

0.0 

4.0 

8.0 

0.0 

8.0 

36.1 

0.0 

36.1 

16.1 

0.3 

16.4 

16.1 

0.3 

16.4 

72.2 

0,0 

72.2 

20.1 

9.4 

29.5 

24.1 

9.2 

33.3 

108.3 

0.0 

108.3 

32.1 

37.4 

69.5 

32.2 

37.1 

69.3 

144.3 

0.1 

144.4 

32.1 

59.2 

91.3 

— 

-- 

-- 

144.3 

0.3 

144.6 

32.1 

69.4 

101.5 

32.2 

31.8 

64.0 

144.3 

0,9 

145.2 

32.1 

86.5 

118,6 

-- 

— 

-- 

144.3 

1.8 

146.1 

32.1 

83.9 

116.0 

32.2 

39.6 

71.8 

144.3 

2.9 

147.2 

32.1 

73.9 

106.0 

-- 

-- 

-- 

144.3 

3.8 

148.1 

32.1 

74.3 

106.4 

31.8 

42.9 

74.7 

144.3 

4.3 

148.6 

32.1 

79.2 

111.3 

-- 

-- 

-- 

144.3 

4.5 

148.8 

32.1 

79.7 

111.8 

31.8 

35.9 

67.7 

144.3 

4.5 

148.8 

32.1 

77.3 

109.4 

-- 

-- 

-- 

144.3 

4.4 

148.7 

32.1 

76.7 

108.8 

31.8 

31.0 

62.8 

144.3 

4.3 

148.6 

32.1 

77.9 

110.0 

-- 

-- 

— 

144.3 

4.3 

148,6 

32.1 

78.3 

110.4 

31.8 

31.4 

63.2 

32.1 

77.8 

110.9 

-- 

— 

-- 

32.1 

77.5 

109.6 

31.8 

33.6 

65.4 

31.8 

33.6 

65.4 

•  - 

31.8  32.6  64.4 


31.8  32.6  64.4 


-- 

-- 

31.8 

33.0 

64.8 
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With  the  linear  relation  plotted  in  Figure  40  for  a  45-day  overhaul 
pipeline  and  values  for  O  and  F  previously  obtained,  the  influence  of  on- 
Base  repair  capability  is  evident.  In  Cases  I  and  IV,  where  relatively  fewer 
failures  occurred  in  comparison  with  removals  for  mandatory  overhaul,  the 
influence  of  on-Base  capability  is  minor.  For  Case  V,  however,  where  a 
very  high  proportion  of  the  total  maintenance  actions  were  irregular  re¬ 
movals  for  failure,  on-Base  repair  capability  has  a  marked  effect.  Several 
interpretations  are  possible  here.  First,  field  maintenance  may  be 
assumed  to  have  the  capability  for  complete  disassembly  of  the  equipment 
and  repair  of  all  types  of  failure.  Second,  field  maintenance  has  only  a 
limited  repair  capability,  but  most  or  all  of  the  failures  are  of  a  minor 
nature  and  within  the  repair  capability.  If  the  repair  capability  is  defined, 
then  the  expected  total  number  of  assemblies  required  becomes  dependent 
upon  the  nature  of  the  failure  and  thus  can  be  related  to  the  reliability  of 
the  assembly.  In  this  analysis,  availability  was  held  constant  at  100  per 
cent  by  assuming  that  repair  and  replacement  were  accomplished  instan¬ 
taneously.  If  the  total  number  of  assemblies  was  held  constant  and  lag 
times  for  repair  and  replacement  were  permitted,  AOCP  rates  and  avail¬ 
ability  would  become  dependent  variables. 


The  Second  Simulation 


From  the  preceding  work,  it  is  evident  that  the  reliability  of  propeller 
controls  in  an  operational  environment  is  not  readily  determinable  without  a 
more  complete  simulation  of  the  other  important  variables  in  the  environ¬ 
ment,  In  the  second  simulation,  a  determined  effort  was  made  to  inject 
more  realism  into  the  simulation  without  undermining  the  validity  of  the  re¬ 
sults.  The  flying  load  imposed  upon  the  operational  unit,  frequency  and 
duration  of  flights,  maintenance  repair  times,  and  certain  other  operational 
parameters  were  permitted  to  vary.  In  the  following  paragraphs,  the 
procedures  and  results  of  the  second  simulation  are  described. 


General  Description  of  the  Simulation 

The  system  to  be  simulated  is  the  flight  operations  and  maintenance 
of  an  operational  unit  equipped  with  four-engine,  turboprop  aircraft  and 
operating  in  the  ZI.  Only  that  portion  of  unit  operations  having  to  do  with 
flying  and  maintaining  the  aircraft  is  considered.  The  objective  is  to  deter¬ 
mine  the  influence  of  propeller -control  reliability  on  the  operational 
capability  of  the  unit. 

The  simulation  is  dynamic  but  is  carried  on  in  nonreal  time.  The 
unit  receives  mission  assignments  and  allocates  aircraft  to  those  missions 
within  the  limits  of  its  capability.  The  missions  are  flown  at  various  times 
of  the  day  and  may  be  aborted  or  may  sustain  a  failure.  In  accordance  with 
probability  of  occurrence  of  such  events,  propeller -control  failures  are 
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identified  and  treated  separately.  Both  general  maintenance  and  propeller 
maintenance  may  be  accomplished  following  the  flights  or  aborted  missions. 
Maintenance  service  time  and  the  availability  of  spare  parts  determine  the 
availability  of  aircraft  for  subsequent  missions.  The  simulation  follows  the 
flying  and  maintenance  operations  for  a  period  of  30  days,  recording  the 
daily  history  and  the  status  at  0800  each  day. 

Dynamic  simulation  of  unit  operations  in  this  fashion  provides  a  basis 
for  determining  the  relative  influence  of  propeller  failure  on  operational 
capability. 


Assumptions 

The  simulation  is  based  on  certain  assumptions  that  fix  the  quantita¬ 
tive  relations  in  the  analysis.  These  assumptions  are  as  follows: 

(1)  The  number  of  aircraft  in  the  systems  is  fixed  at  50 
(catastrophic  failure  is  neglected). 

(2)  Flight  operations  and  maintenance  were  conducted  on  an 
hourly  basis  and  flight  and  repair  schedules  are  pre¬ 
scribed  in  1-hour  increments. 

(3)  All  flights  originate  and  terminate  at  one  Base.  All 
maintenance  activities  are  conducted  at  this  Base. 

(Multiple -Base  operations  could  be  considered  with  only 
minor  modifications  in  the  maintenance  scheduling.) 

(4)  Missions  are  flown  daily  on  a  5 -day -week  basis.  The  num¬ 
ber  of  missions  to  be  flown  during  any  24-hour  period  is 
generated  at  0800  each  day.  No  missions  are  generated 
for  the  2-day  weekend,  but  missions  assigned  on  the  fifth 
day  that  have  not  been  flown  by  0800  on  the  sixth  day  are 
reassigned,  thus  simulating  a  reduced  operational  require¬ 
ment  during  this  period. 

(5)  A  mission  abort  is  assumed  to  occur  prior  to  take-off  and 
the  mission  is  not  reassigned  until  the  following  hour. 

(6)  The  probability  of  propeller  failure  per  hour  is  assumed 
constant  and  independent  of  propeller  age.  The  contingency 
of  more  than  one  propeller  failure  per  flight  is  not 
considered. 

(7)  After  take-off,  the  mission  is  completed,  regardless  of 
malfunction  of  the  propeller  or  of  any  other  system. 
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i  (8)  General  maintenance  is  required  following  each  mission  or 
abort.  Propeller  maintenance  is  required  only  if  the  in¬ 
flight  failure  or  abort  was  due  to  propeller  malfunction. 

(9)  General  maintenance  and  propeller  maintenance  are  conducted 
on  the  basis  of  two  8-hour  shifts  in  a  5-day  week.  New 
maintenance  work  is  not  assigned  on  the  2-day  weekend,  but 
uncompleted  maintenance  on  the  fifth  day  requires  weekend 
maintenance  activity.  There  is  no  exchange  of  personnel 
between  general  and  propeller  maintenance. 

(10)  The  number  of  men  assigned  to  specific  maintenance  tasks 
is  fixed  and  limited  to  not  more  than  four. 

(11)  Periodic  inspections  are  performed  when  aircraft  flight 
time  reaches  specified  values,  e.g,  ,  150  and  300  hours. 
Maintenance  required  for  a  150-hour  inspection  is  assumed 
to  be  24  consecutive  hours.  Maintenance  required  for  a 
300-hour  inspection  is  assumed  to  be  120  consecutive  hours. 
Inspection  is  accomplished  following  the  mission  that  over¬ 
flies  the  inspection  time. 

(12)  AOCP  is  assumed  to  occur  in  a  fixed  fraction  of  the  main¬ 
tenance  actions  required.  Not  more  than  one  AOCP  occurs 
for  each  maintenance  repair  job.  Maintenance  is  delayed 
until  AOCP  is  rectified.  General  and  propeller  maintenance 
channels  are  regarded  as  separate,  and  AOCP  is  determined 
for  each,  independently  of  the  other.  Both  types  of  main¬ 
tenance  may  be  performed  on  a  specific  aircraft  simultaneously, 
and  progress  through  the  two  channels  is  not  necessarily 
parallel.  For  example,  the  aircraft  may  be  in  the  propeller 
maintenance  queue  while  general  maintenance  is  in  progress. 

(13)  Maintenance  queues  are  considered  to  form  when  the  men 
available  are  not  sufficient  to  undertake  a  specific  job 
assignment. 


Initial  Conditions 

At  the  beginning  of  the  simulation,  the  aircraft  and  propellers  were 
aged  in  accordance  with  the  first  simulation  program  and  field  experience. 
It  was  assumed  that  half  of  the  aircraft  were  available  at  the  start  of 
operations  at  0800  on  the  first  day,  and  the  other  half  were  distributed  in 
maintenance  channels  and  in  flight  status. 
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Parameter  Variations 


The  parameters  of  interest  in  the  simulation  are  those  that  influence 
operational  capability  when  a  propeller  failure  occurs.  The  rate  at  which 
flying  activity  produces  propeller  failures  determines  the  maintenance  load. 
The  maintenance  counter  action ,  the  rate  at  which  maintenance  returns  com¬ 
plete  aircraft  to  service,  acts  in  opposition  to  the  rate  at  which  missions 
can  be  accomplished  and  thus  generate  failures.  Hence,  the  parameters  of 
interest  include  the  flying  load,  characteristics  of  equipment,  failure  in 
terms  of  frequency  and  extent  of  repair  required,  and  the  characteristics  of 
the  maintenance  force. 

Many  of  the  events  affecting  disposition  of  aircraft  occur  at  random, 
for  example,  propeller  failure  during  flight,  or  maintenance  repair  time 
required  for  that  failure.  To  express  the  random  nature  of  these  variables, 
Monte  Carlo  techniques  are  used  to  select  specific  values  from  prescribed 
distributions.  Operational  data  available  provide  a  real  although  limited 
basis  for  determining  such  distributions.  However,  these  data  provide  a 
reasonable  indication  of  the  relative  frequency  of  such  events  and,  if  the 
analysis  is  continued  for  a  sufficient  period  of  time,  the  repeated  applica¬ 
tion  of  random  selection  (Monte  Carlo  techniques)  should  produce  the  same 
relative  frequency  of  events.  Parameter  variations  introduced  in  the 
simulations  are  summarized  in  Table  7,  The  numerical  values  shown  are 
average  or  mean  values  descriptive  of  the  parametric  distributions  actually 
employed.  Discrete  values  in  the  frequency  distribution  for  each  parameter 
are  given  in  appropriate  tables  later  on.  Methods  of  generating  the  dis¬ 
tributions  and  their  use  in  a  computer  simulation  are  discussed  later  in  the 
context  of  the  computer  model. 


Results  of  the  Second  Simulation 


The  computer  model  used  to  simulate  operational  use  of  a  turboprop 
system  provides  a  means  for  analyzing  the  effects  of  propeller  reliability 
on  the  operational  capability  of  an  aircraft  system.  To  analyze  the  effects 
on  the  system  performance  properly,  several  measures  of  effectiveness  of 
propeller  reliability  were  selected.  The  basic  measures  of  systems  per¬ 
formance  are  as  follows: 

(1)  The  number  of  aircraft  in  the  propeller  maintenance  queue 
as  a  function  of  time 

(2)  Aircraft  availability 

(3)  Number  of  missions  accomplished 

(4)  The  number  of  unassigned  propeller  maintenance  personnel. 
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The  operational  effects  of  propeller  reliability  on  the  system,  as 
measured  by  the  above  criteria,  were  analyzed  as  a  function  of  the  following 
inputs: 

(1)  Flying  load 

(2)  Mission  duration 

(3)  Probability  of  propeller  malfunction 

(4)  Probability  of  propeller  AOCP 

(5)  Propeller  repair  time 

(6)  Number  of  propeller  maintenance  personnel. 

The  operational  environment  in  which  the  propeller  is  presumed  to  operate 
was  constructed  in  terms  of  the  flying  schedule,  the  work-week,  and 
general  maintenance  variables.  The  latter  may  affect  aircraft  availability 
and  missions  accomplished  to  a  greater  extent  than  propeller  reliability. 
This  study  is  not  concerned  with  examining  general  maintenance,  and  it  is 
included  solely  as  a  means  for  establishing  the  context  of  the  operational 
environment. 


The  Basic  Case 


To  evaluate  the  influence  of  certain  reliability  parameters  on  opera¬ 
tional  capability,  it  is  first  necessary  to  postulate  the  basic  set  of  param¬ 
eters  and  realistic  values  for  a  basic  case.  The  parameter  values  may  then 
be  varied  and  the  effect  on  operational  capability  observed  and  analyzed. 
Numerical  values  for  the  parameter  variations  are  listed  in  Table  7  for 
Simulation  Runs  1  through  12.  In  the  discussion  that  follows,  the  simulation 
runs  are  analyzed  in  the  order  in  which  they  appear  in  Table  7. 

The  parameter  values  shown  in  Table  7  for  Simulation  Run  1  constitute 
the  basic  case.  These  values  represent  a  reasonable  approximation  of  the 
operational  situation  for  a  fairly  reliable  propeller. 

The  results  of  the  computer  simulation  for  the  basic  case  are  shown 
in  Table  8,  For  the  given  propeller  reliability  and  maintenance  support, 
mission  requirements  are  completed  with  very  little  trouble.  Propeller 
failures  of  any  kind  are  infrequent,  and  those  that  do  occur  require  little 
maintenance.  The  number  of  propeller  maintenance  personnel  available  is 
far  greater  than  the  number  actually  needed  to  maintain  operational 
capability. 

The  basic  case  is  shown  to  illustrate  an  operational  situation  in  which 
the  propeller  is  quite  reliable  and  can  be  returned  to  service  very  quickly 
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in  the  event  of  failure.  It  will  be  noted  in  this  and  subsequent  cases  that  the 
flying  load  and  number  of  propeller  failures  per  day  show  a  fairly  wide 
fluctuation.  These  are  characteristic  of  real  operations  and  often  make 
reliability  difficult  to  measure,  as  well  as  contributing  to  the  illusion  of  a 
constantly  changing  reliability.  It  should  also  be  noted  that,  in  this  and 
subsequent  cases,  Day  1  represents  initial  conditions,  and  mission  require¬ 
ments  are  not  actually  generated  until  Day  2. 


Influence  of  High  Propeller  AOCP  Rates 

To  observe  the  effect  of  AOCP  rate  on  operational  capability,  the 
probability  of  AOCP  following  a  flight  or  an  abort  was  increased  from  0. 10 
to  0.  30,  This  was  applied  to  both  general  and  propeller  maintenance 
channels  and  represents  a  general  inadequacy  of  logistic  support. 

An  evaluation  of  the  unit  operational  capability  for  this  condition  is 
given  in  Table  9.  The  increased  AOCP  rate  for  propellers  does  not 
significantly  influence  the  ability  to  complete  mission  requirements.  The 
number  of  propeller  injunctions  remains  relatively  small,  and  AOCP  does 
not  occur  except  in  the  case  of  a  malfunction  requiring  replacement  of  a 
component  or  part.  The  over -all  capability  of  the  unit  is  noticeably 
affected  by  the  AOCP  rate  in  general  maintenance.  This  is  not  of  special 
interest  here  except  as  an  environmental  background  for  propeller  operation. 

The  appearance  of  one  aircraft  in  the  propeller  maintenance  queue  on 
the  seventh  day  (i.e,  ,  Sunday)  results  from  the  context  of  the  simulation. 

The  model  is  designed  so  that  maintenance  requirements  generated  on  a 
weekend  day  are  not  assigned  to  the  work  force  until  the  following  Monday. 

In  this  and  subsequent  cases,  maintenance  generated  by  aircraft  returning 
from  flights  on  the  weekend  is  held  in  the  appropriate  maintenance  queue 
until  Monday  morning. 


Influence  of  Increased  Flying  Load 


In  an  attempt  to  stress  the  system,  the  average  number  of  missions 
assigned  per  month  was  increased  from  740  to  1480,  This  would  be  similar 
to  a  unit  operating  a  large  number  of  short  flights  per  day,  as  in  training 
operations  or  short-haul  cargo  operations.  The  results  for  this  simulation 
are  shown  in  Table  10. 

Under  these  conditions,  a  substantial  number  of  the  assigned  missions 
cannot  be  flown.  However,  the  reduced  operational  capability  cannot  be 
attributed  to  propeller  reliability.  The  requirement  for  postflight  general 
maintenance  is  sufficient  to  limit  aircraft  availability  under  these  conditions. 
The  number  of  propeller  malfunctions  increases  because  of  the  increase  in 
number  of  exposures,  but  nowhere  do  aircraft  appear  in  the  propeller 
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TABLE  8.  EVALUATION 
The  Basic 


Day 

Missions 

Generated 

Missions 

Flown 

Operations 

Total 

Flying 

Hours 

Propeller 

Aborts 

Other 

Aborts 

Propeller 

Malfunctions 

A/C  in  Propeller 
Maintenance 
Queue 

Propeller 

AOCP 

Propeller 

1 

30 

76 

0 

0 

2 

0 

0 

2 

32 

32 

63 

0 

0 

2 

0 

2 

3 

32 

32 

73 

0 

1 

2 

0 

0 

4 

40 

40 

100 

1 

1 

2 

0 

0 

5 

28 

28 

81 

0 

1 

3 

0 

0 

6 

0 

0 

0 

0 

0 

0 

0 

0 

7 

0 

0 

0 

0 

0 

0 

0 

0 

8 

30 

30 

68 

0 

5 

2 

0 

0 

9 

22 

22 

61 

0 

1 

1 

0 

0 

10 

32 

32 

86 

0 

2 

2 

0 

0 

11 

48 

48 

106 

0 

1 

4 

0 

0 

12 

34 

34 

65 

0 

1 

1 

0 

0 

13 

0 

0 

0 

0 

0 

0 

0 

0 

14 

0 

0 

0 

0 

0 

0 

0 

0 

15 

38 

38 

97 

0 

2 

4 

0 

0 

16 

24 

24 

51 

0 

2 

0 

0 

0 

17 

34 

34 

78 

0 

1 

3 

0 

0 

18 

38 

38 

103 

1 

2 

0 

0 

0 

19 

30 

30 

77 

0 

1 

3 

0 

0 

20 

0 

0 

0 

0 

0 

0 

0 

0 

21 

0 

0 

0 

0 

0 

0 

0 

0 

22 

30 

30 

61 

0 

2 

0 

0 

0 

23 

38 

38 

91 

1 

1 

1 

0 

0 

24 

42 

42 

95 

0 

1 

6 

0 

0 

25 

38 

38 

82 

1 

0 

2 

0 

0 

26 

38 

38 

86 

0 

1 

2 

0 

0 

27 

0 

0 

0 

0 

0 

0 

0 

0 

28 

0 

0 

0 

0 

0 

0 

0 

0 

29 

38 

38 

96 

0 

2 

2 

0 

0 

30 

36 

36 

97 

0 

2 

3 

0 

0 
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OF  SIMULATION  RUN  1 


Case. 


Maintenance 

General  Maintenance 

Man-Hours 

Number  of  Propeller 

Man-Hours 

Number  of  General 

of  Propeller 

Maintenance 

A/C  in  General 

of  General 

Maintenance 

Maintenance 

Personnel 

Maintenance 

AOCP 

Maintenance 

Personnel 

Assigned 

Unassigned 

Queue 

General 

Assigned 

Unassigned 

31 

30 

0 

0 

587 

0 

11 

30 

0 

10 

773 

74 

17 

30 

0 

9 

672 

63 

21 

30 

0 

14 

882 

71 

13 

30 

0 

17 

595 

58 

0 

30 

0 

13 

0 

68 

0 

30 

6 

7 

0 

100 

6 

30 

11 

2 

820 

100 

8 

30 

0 

3 

350 

81 

3 

30 

0 

3 

497 

91 

9 

30 

0 

8 

898 

86 

2 

30 

0 

10 

551 

66 

0 

30 

0 

11 

0 

89 

0 

30 

2 

9 

0 

100 

15 

30 

4 

7 

1099 

100 

0 

30 

0 

4 

513 

68 

7 

30 

0 

4 

463 

80 

2 

30 

0 

8 

598 

87 

6 

30 

0 

9 

585 

76 

0 

30 

0 

13 

0 

83 

0 

30 

6 

7 

0 

100 

0 

30 

8 

5 

729 

100 

9 

30 

0 

2 

636 

80 

30 

30 

0 

4 

676 

81 

7 

30 

0 

7 

753 

83 

5 

30 

0 

6 

791 

70 

0 

30 

0 

9 

0 

64 

0 

30 

3 

6 

0 

100 

5 

30 

8 

1 

826 

100 

7 

30 

0 

3 

644 

75 
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TABLE  9.  EVALUATION 


Propeller 

All  other  maintenance  parameters 


Day 

Missions 

Generated 

Operations 

Total 

Missions  Flying 
Flown  Hours 

Propeller 

Aborts 

Other 

Aborts 

Propeller 

Malfunctions 

A/C  in  Propeller 
Maintenance 
Queue 

Propeller 

AOCP 

Propeller 

1 

-- 

32 

73 

1 

1 

2 

0 

0 

2 

32 

27 

71 

0 

2 

2 

0 

2 

3 

36 

17 

59 

0 

2 

0 

0 

0 

4 

36 

25 

30 

0 

1 

1 

0 

0 

5 

38 

13 

63 

0 

1 

2 

0 

0 

6 

0 

0 

38 

0 

0 

0 

0 

0 

7 

0 

36 

0 

0 

0 

0 

1 

0 

8 

36 

20 

96 

1 

1 

4 

1 

0 

9 

20 

40 

37 

0 

2 

1 

0 

0 

10 

40 

29 

93 

1 

2 

2 

0 

0 

11 

30 

24 

77 

0 

1 

2 

0 

0 

12 

32 

8 

49 

1 

1 

2 

0 

0 

13 

0 

0 

14 

0 

0 

0 

0 

0 

14 

0 

44 

0 

0 

0 

0 

0 

0 

15 

44 

30 

112 

0 

0 

1 

0 

0 

16 

30 

36 

53 

0 

2 

1 

0 

0 

17 

36 

26 

77 

0 

2 

2 

0 

0 

18 

26 

32 

57 

0 

1 

0 

0 

0 

19 

32 

0 

63 

0 

0 

2 

0 

1 

20 

0 

0 

0 

0 

0 

0 

0 

1 

21 

0 

40 

0 

0 

0 

0 

0 

2 

22 

40 

28 

92 

0 

3 

2 

0 

1 

23 

28 

34 

67 

1 

1 

3 

0 

1 

24 

34 

30 

76 

0 

3 

2 

0 

1 

25 

30 

27 

73 

0 

2 

3 

0 

0 

26 

40 

13 

69 

0 

0 

0 

0 

0 

27 

0 

0 

24 

0 

1 

0 

0 

0 

28 

0 

30 

0 

0 

0 

0 

0 

0 

29 

30 

40 

73 

0 

0 

4 

0 

0 

30 

40 

38 

76 

1 

3 

2 

0 

0 
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OF  SIMULATION  RUN  2 


AOCP  -  0, 30 

are  the  same  as  for  the  basic  case. 


Maintenance 

General  Maintenance 

Man-Hours 
of  Propeller 
Maintenance 
Assigned 

Number  of  Propeller 
Maintenance 

Personnel 

Unassigned 

A/C  in  Genera] 
Maintenance 
Queue 

AOCP 

General 

Man-Hours 
of  General 
Maintenance 
Assigned 

Number  of  General 
Maintenance 
Personnel 
Unatsigned 

30 

30 

0 

0 

580 

0 

13 

30 

0 

17 

394 

76 

0 

30 

0 

24 

315 

79 

3 

30 

0 

30 

459 

60 

7 

30 

0 

29 

546 

57 

0 

30 

0 

25 

0 

49 

0 

30 

1 

19 

0 

94 

23 

30 

1 

13 

930 

100 

2 

30 

0 

21 

264 

52 

8 

30 

0 

20 

706 

85 

8 

29 

0 

26 

505 

54 

5 

30 

0 

28 

465 

55 

0 

30 

0 

29 

0 

58 

0 

30 

0 

23 

0 

96 

9 

30 

0 

11 

1301 

100 

4 

28 

0 

12 

537 

32 

9 

30 

0 

17 

498 

76 

0 

30 

0 

26 

429 

79 

3 

30 

0 

23 

574 

72 

0 

30 

0 

25 

0 

71 

0 

30 

0 

17 

0 

97 

15 

30 

0 

8 

815 

100 

16 

30 

0 

16 

707 

70 

10 

30 

0 

14 

550 

74 

10 

30 

0 

22 

455 

78 

0 

29 

0 

32 

606 

78 

0 

30 

0 

26 

0 

48 

0 

30 

0 

21 

0 

93 

24 

30 

0 

8 

972 

100 

5 

28 

0 

13 

540 

66 
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TABLE  10.  EVALUATION  OF 


I 

3 


Average  Number  of 
All  other  maintenance  parameters 


Day 

Operations 

Propeller 

Malfunctions 

A/C  in 
Propeller 
Maintenance 
Queue 

Propeller 

AOCP 

Propeller 

Missions 

Generated 

Missions 

Flown 

Total 

Flying 

Hours 

Propeller 

Aborts 

Other  Aborts 

1 

.. 

24 

60 

0 

2 

1 

0 

0 

2 

61 

61 

149 

1 

2 

7 

0 

3 

3 

67 

58 

144 

0 

1 

6 

0 

1 

4 

73 

46 

100 

0 

1 

3 

0 

0 

5 

67 

38 

77 

0 

4 

4 

0 

0 

6 

0 

27 

66 

0 

2 

1 

0 

0 

7 

0 

2 

8 

0 

0 

0 

0 

0 

8 

59 

53 

140 

0 

2 

9 

0 

0 

9 

67 

55 

121 

0 

1 

3 

0 

0 

10 

53 

49 

101 

1 

4 

2 

0 

0 

11 

63 

46 

100 

0 

3 

2 

0 

0 

12 

71 

48 

90 

0 

1 

2 

0 

0 

13 

0 

23 

51 

0 

0 

2 

0 

0 

14 

0 

0 

0 

0 

0 

0 

0 

0 

15 

56 

49 

120 

0 

1 

3 

0 

0 

16 

67 

39 

93 

0 

4 

4 

0 

0 

17 

79 

55 

134 

0 

1 

5 

0 

0 

18 

73 

52 

122 

0 

0 

6 

0 

0 

19 

63 

63 

137 

0 

2 

5 

0 

0 

20 

0 

0 

0 

0 

0 

0 

0 

0 

21 

0 

0 

0 

0 

0 

0 

0 

0 

22 

71 

71 

176 

0 

1 

5 

0 

0 

23 

81 

51 

119 

0 

2 

4 

0 

0 

24 

79 

52 

136 

0 

3 

5 

0 

0 

26 

56 

36 

85 

2 

4 

3 

0 

0 

26 

50 

50 

119 

0 

2 

2 

0 

0 

27 

0 

0 

0 

0 

0 

0 

0 

0 

28 

0 

0 

0 

0 

0 

0 

0 

0 

29 

67 

67 

142 

1 

3 

5 

0 

0 

30 

65 

62 

148 

1 

9 

5 

0 

0 
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SIMULATION  RUN  3 

Missions  per  Month  *  1480 
are  the  tame  at  for  the  basic  cate. 


Maintenance 

General  Maintenance 

Man-Hours  of 
Propeller 
Maintenance 
Assigned 

Number  of  Propeller 
Maintenance 
Personnel 
Unassigned 

A/C  in  General 
Maintenance 
Queue 

AOCP 

General 

Man-Hours  of 
General 

Maintenance 

Assigned 

Number  of  General 
Maintenance 

Personnel 

Unassigned 

24 

30 

0 

0 

756 

0 

16 

30 

0 

10 

942 

76 

21 

30 

0 

10 

951 

38 

26 

22 

0 

10 

946 

14 

22 

27 

0 

13 

681 

24 

0 

25 

0 

15 

0 

36 

0 

30 

28 

16 

0 

93 

31 

30 

36 

10 

1780 

100 

6 

26 

4 

10 

922 

0 

17 

28 

1 

12 

861 

16 

7 

30 

0 

13 

1015 

13 

9 

26 

0 

12 

675 

11 

0 

30 

0 

20 

0 

31 

0 

30 

22 

16 

0 

100 

20 

30 

31 

12 

1663 

100 

27 

25 

0 

12 

669 

80 

23 

26 

0 

12 

948 

25 

24 

22 

0 

10 

1063 

13 

12 

24 

2 

9 

1049 

13 

0 

28 

1 

12 

0 

9 

0 

30 

4 

8 

0 

89 

9 

30 

6 

6 

1493 

100 

4 

30 

0 

8 

891 

16 

32 

29 

0 

10 

966 

7 

18 

21 

0 

16 

930 

24 

6 

26 

0 

13 

1119 

16 

0 

30 

0 

11 

0 

3 

0 

30 

5 

6 

0 

92 

26 

30 

5 

6 

1081 

100 

26 

26 

0 

4 

1171 

59 

-.mm* 
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maintenance  queue  at  the  beginning  of  daily  operations.  The  number  of  pro¬ 
peller  personnel  available  are  more  than  adequate  to  maintain  the  propellers 
with  the  very  short  service  time  required.  Less  than  15  per  cent  of  the 
available  propeller  maintenance  man-hours  are  utilized  on  a  one-shift  basis. 


Influence  of  Increased  Mission  Duration 


On  the  fourth  simulation  run,  mission  duration  was  increased  to  6 
hours  and  assumed  to  be  the  same  for  all  flights.  This  can  be  viewed  as 
equivalent  to  long-haul  cargo  operations  on  an  overseas  run  if  it  is  assumed 
that  all  maintenance  must  be  accomplished  by  personnel  from  the  parent 
Base.  The  results  are  summarized  in  Table  11. 

In  comparison  with  the  basic  case,  the  effect  of  increasing  the  mission 
duration  is  essentially  an  increase  in  the  number  of  flying  hours.  There 
appear  to  be  no  adverse  effects.  Mission  requirements  are  completed  on  the 
day  assigned  with  one  exception,  on  Day  27,  when  one  mission  was  flown 
late. 


Influence  of  Increased  Propeller 
Malfunction  Rates 


Up  to  this  point,  propeller  malfunction  rate  has  been  held  at  the  rela¬ 
tively  low  probability  of  0.  008  per  hour.  In  this  case,  this  value  is  increased 
by  an  order  of  magnitude  of  0.  1  per  hour,  with  the  values  of  all  other  param¬ 
eters  remaining  the  same  as  those  in  the  basic  case.  An  evaluation  of  this 
situation  is  shown  in  Table  12. 

A  substantial  increase  in  the  number  of  propeller  malfunctions  occurs 
as  a  result  of  the  increased  probability  of  malfunction.  The  number  of 
maintenance  man-hours  required  to  repair  the  propeller  likewise  increases. 
However,  there  is  no  apparent  effect  on  the  operational  capability  of  the  unit. 

It  can  be  concluded  from  this  and  previous  runs  that  a  very  short 
service  time  for  propeller  repair  and  replacement  when  malfunctions  are 
minor  (used  here  on  the  basis  of  field  experience)  is  able  to  overcome 
adverse  malfunction  rates.  A  comparable  situation  arose  in  the  first 
simulation  when  field  maintenance  was  sufficiently  flexible  to  overcome  a 
high  incidence  of  minor  malfunctions . 


Influence  of  Increased  Propeller  Repair  Time 

As  a  result  of  the  findings  of  previous  simulations,  a  more  stringent 
propeller  maintenance  problem  was  posed  by  increasing  the  propeller  re¬ 
pair  time.  This  was  done  by  increasing  the  frequency  of  occurrence  of  the 
10-  and  11 -man-hour  tasks  (see  Table  23,  at  the  end  of  this  section).  It 
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has  been  observed  that  maintenance  repair  times  tend  to  cluster  about  cer¬ 
tain  discrete  values  representing  the  repair  times  for  certain  particular 
kinds  of  malfunctions.  For  existing  turboprop  systems,  a  10-  to  11 -man¬ 
hour  task  might  correspond  to  removal  of  the  propeller  to  replace  a  vital 
component.  In  several  subsequent  cases,  propeller  repair  times  were  in¬ 
creased  still  further  to  demonstrate  their  effect  on  operational  capability. 

An  evaluation  of  this  simulation  run  appears  in  Table  13,  with  a 
probability  failure  of  only  0.  008  per  hour.  At  this  level  of  reliability 
(equivalent  to  presently  operating  systems),  the  number  of  propeller  mal¬ 
functions  occurring  is  too  few  to  affect  the  operational  capability  of  the  unit. 


Influence  of  Combined  Increases  in 
Simulation  Parameters 


It  is  evident  from  the  preceding  discussion  that  reasonable  variations 
in  the  values  of  any  one  of  the  simulation  parameters  are  not  sufficient  to 
produce  significant  changes  in  operational  capability  from  the  standpoint  of 
propeller  reliability.  It  is  therefore  desirable  to  see  the  effect  of  increases 
in  more  than  one  of  the  parameters  simulatneously. 

The  results  of  Simulation  Runs  7,  8,  and  9  are  shown  in  Tables  14, 

15,  and  16,  respectively.  The  conditions  imposed  on  the  operating  unit  in 
these  cases  include  an  average  flying  load  of  1480  missions  per  month, 
mission  durations  of  from  1  to  6  hours,  probability  of  propeller  malfunction 
0.  1,  and  three  alternative  schedules  of  propeller  repair  time,  two  previously 
introduced  and  the  third  of  a  more  stringent  nature. 

In  the  operational  situation  for  these  three  cases,  unit  capability  is 
affected  more  by  general  maintenance  limitations  than  by  the  propeller  fail¬ 
ure  and  maintenance  process.  However,  this  would  not  be  unusual  in  real 
operations,  where  experience  shows  propeller  systems  seldom  cause  more 
than  10  per  cent  of  the  maintenance  load.  In  Table  14,  the  frequency  of 
propeller  malfunctions  is  sufficient  to  cause  some  AOCP  problems  and  in¬ 
frequent  queuing,  but  the  propeller  maintenance  force  is  seldom  fully 
occupied. 

In  Table  15,  increasing  the  propeller  maintenance  task  by  increasing 
the  frequency  of  occurrence  of  certain  types  of  failures  requiring  a  greater 
repair  time  places  a  substantial  burden  on  the  maintenance  process.  The 
unit  is  not  meeting  its  operational  requirement,  but  again  this  is  mainly  due 
to  general  maintenance.  Comparing  Table  14  with  Table  15  shows  that  the 
increase  in  propeller  maintenance  does  not  influence  unit  capability 
significantly. 

In  Table  16,  the  propeller  maintenance  task  has  been  made  still  more 
difficult.  Now  the  full  capacity  of  a  two-shift  operation  is  being  utilized, 
but  this  is  not  sufficient  to  prevent  aircraft  delays  in  the  propeller 
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TABLE  11.  EVALUATION  OF 

Mission  Duration 
Ail  other  maintenance  parameters  are 


Day 

Operations 

Propeller 

Malfunctions 

A/C  in 
Propeller 
Maintenance 
Queue 

Propeller 

AOCP 

Propeller 

Missions 

Generated 

Missions 

Flown 

Total 

Flying  Propeller 
Hours  Aborts 

Other  Aborts 

1 

.. 

30 

180 

0 

1 

11 

0 

0 

2 

36 

36 

216 

1 

2 

3 

0 

2 

3 

38 

38 

228 

0 

2 

8 

0 

0 

4 

32 

32 

192 

0 

2 

6 

0 

0 

5 

40 

40 

240 

0 

4 

10 

0 

0 

6 

0 

0 

0 

0 

0 

0 

0 

0 

7 

0 

0 

0 

0 

0 

0 

0 

0 

8 

38 

38 

228 

0 

4 

7 

0 

0 

9 

40 

40 

240 

2 

2 

3 

0 

0 

10 

40 

40 

240 

1 

2 

7 

0 

0 

11 

40 

40 

240 

0 

2 

5 

0 

0 

12 

32 

32 

192 

0 

2 

5 

0 

0 

13 

0 

0 

0 

0 

0 

0 

0 

0 

14 

0 

0 

0 

0 

0 

0 

0 

0 

15 

38 

38 

228 

1 

3 

8 

0 

0 

16 

36 

36 

216 

0 

2 

4 

0 

0 

17 

32 

32 

192 

0 

2 

5 

0 

0 

18 

32 

32 

192 

1 

1 

5 

0 

0 

19 

32 

32 

192 

0 

2 

3 

0 

0 

20 

0 

0 

0 

0 

0 

0 

0 

0 

21 

0 

0 

0 

0 

0 

0 

0 

0 

22 

32 

32 

192 

0 

2 

5 

0 

0 

23 

42 

42 

252 

0 

3 

11 

0 

1 

24 

30 

30 

180 

0 

2 

2 

0 

0 

25 

36 

36 

216 

0 

1 

9 

0 

0 

26 

44 

43 

258 

0 

1 

17 

0 

0 

27 

0 

41 

6 

0 

0 

0 

4 

0 

28 

0 

0 

0 

0 

0 

0 

0 

0 

29 

26 

26 

156 

0 

1 

9 

0 

0 

30 

32 

32 

192 

1 

3 

5 

0 

0 

1 

\ 
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SIMULATION  RUN  4 
-  6  Hours 

the  same  as  for  the  basic  case . 


Maintenance 

General  Maintenance 

Man-Hours  of 
Propeller 
Maintenance 
Assigned 

Number  of  Propeller 
Maintenance 
Personnel 
Unasslgned 

A/C  in  General 
Maintenance 
Queue 

AOCP 

General 

Man-Hours  of 
General 

Maintenance 

Assigned 

Number  of  General 
Maintenance 

Personnel 

Unassigned 

57 

30 

0 

0 

587 

0 

18 

30 

0 

7 

691 

71 

10 

30 

0 

8 

578 

59 

18 

30 

1 

10 

376 

51 

38 

27 

0 

11 

844 

78 

0 

21 

0 

8 

0 

19 

0 

30 

5 

3 

0 

94 

23 

30 

8 

1 

825 

100 

13 

28 

0 

6 

860 

63 

32 

28 

0 

10 

899 

47 

11 

23 

0 

12 

817 

34 

11 

25 

0 

14 

567 

25 

0 

27 

0 

15 

0 

37 

0 

30 

5 

10 

0 

96 

35 

30 

10 

5 

855 

100 

6 

23 

0 

6 

679 

60 

34 

30 

0 

5 

668 

54 

11 

27 

0 

6 

538 

52 

12 

30 

0 

6 

602 

63 

0 

30 

0 

6 

0 

79 

0 

30 

2 

4 

0 

93 

17 

30 

4 

2 

733 

100 

24 

30 

0 

5 

739 

63 

2 

29 

0 

11 

688 

60 

58 

29 

0 

14 

553 

48 

60 

21 

0 

15 

840 

47 

0 

13 

3 

14 

0 

25 

0 

30 

6 

9 

0 

94 

27 

30 

10 

5 

730 

100 

33 

30 

1 

4 

510 

73 

m*mrm 
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TABLE  12.  EVALUATION  OF 

Probability  of  Propeller 
All  other  maintenance  parameters  are 


Propeller 

Operations 

A/Cin 

Total 

Propeller 

Missions 

Missions 

Flying  Propeller 

Propeller 

Maintenance 

AOCP 

Day 

Generated 

Flown 

Hours 

Aborts 

Other  Aborts 

Malfunctions 

Queue 

Propeller 

1 

.. 

30 

76 

0 

1 

16 

0 

0 

2 

32 

32 

69 

0 

1 

18 

0 

2 

3 

30 

30 

73 

0 

1 

18 

0 

0 

4 

24 

24 

46 

0 

1 

14 

0 

0 

5 

34 

34 

70 

0 

0 

14 

0 

0 

6 

0 

0 

0 

0 

0 

0 

0 

0 

7 

0 

0 

0 

0 

0 

0 

0 

0 

8 

30 

30 

88 

0 

1 

17 

0 

0 

9 

38 

38 

88 

0 

2 

19 

0 

0 

1C 

48 

48 

116 

2 

4 

27 

0 

0 

11 

44 

44 

95 

0 

2 

23 

0 

0 

12 

28 

28 

58 

0 

3 

16 

0 

0 

13 

0 

0 

0 

0 

0 

0 

0 

0 

14 

0 

0 

0 

0 

0 

0 

0 

0 

15 

30 

30 

50 

0 

0 

11 

0 

0 

16 

40 

40 

99 

0 

3 

21 

0 

0 

17 

22 

22 

53 

0 

0 

12 

0 

0 

18 

40 

40 

82 

0 

2 

20 

0 

0 

19 

28 

28 

67 

0 

1 

20 

0 

1 

20 

0 

0 

0 

0 

0 

0 

0 

1 

21 

0 

0 

0 

0 

0 

0 

0 

1 

22 

40 

40 

90 

0 

3 

23 

0 

1 

23 

32 

32 

77 

2 

3 

24 

0 

1 

24 

22 

22 

35 

1 

0 

10 

0 

1 

25 

26 

26 

65 

1 

1 

13 

0 

0 

26 

34 

34 

76 

0 

1 

25 

0 

0 

27 

0 

0 

0 

0 

0 

0 

0 

0 

28 

0 

0 

0 

0 

0 

0 

0 

0 

29 

26 

26 

52 

0 

2 

13 

0 

0 

30 

34 

34 

71 

0 

2 

19 

0 

0 

WADC  TR  59-106 


156 


SIMULATION  RUN  5 


Malfunction  -  0. 1 

the  same  as  for  the  basic  case. 


Maintenance 

General  Maintenance 

Man-Hours  of  1 
Propeller 
Maintenance 
Assigned 

Number  of  Propeller 
Maintenance 
Personnel 
Unassigned 

A/C  in  General 
Maintenance 
Queue 

AOCP 

General 

Man-Hours  of 
General 

Maintenance 

Assigned 

Number  of  General 
Maintenance 

Personnel 

Unassigned 

76 

30 

0 

0 

1026 

0 

62 

29 

0 

6 

861 

59 

53 

30 

0 

5 

615 

66 

33 

30 

0 

9 

445 

74 

40 

30 

0 

9 

503 

89 

0 

30 

0 

12 

0 

92 

0 

30 

5 

7 

0 

100 

59 

30 

9 

3 

748 

100 

64 

30 

0 

6 

346 

79 

88 

30 

0 

10 

780 

88 

83 

30 

0 

14 

1161 

66 

52 

20 

0 

10 

547 

27 

0 

30 

0 

6 

0 

74 

0 

30 

3 

3 

0 

93 

38 

30 

3 

3 

578 

100 

93 

30 

0 

3 

681 

75 

39 

30 

0 

5 

468 

70 

68 

30 

0 

5 

693 

79 

75 

30 

0 

6 

472 

73 

0 

30 

1 

8 

0 

87 

0 

30 

1 

7 

0 

100 

63 

30 

4 

4 

720 

100 

71 

30 

0 

5 

640 

76 

75 

30 

0 

7 

497 

81 

92 

30 

0 

7 

586 

90 

64 

27 

0 

6 

698 

86 

0 

30 

0 

7 

0 

73 

0 

30 

1 

6 

0 

100 

39 

30 

6 

1 

639 

100 

53 

30 

0 

2 

702 

83 
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TABLE  13.  EVALUATION  OF 

Propeller  Repair  Time  - 
All  other  maintenance  parameters 


Operations 

Propeller  Maintenance 

Missions 

Missions 

Total 

Flying 

Propeller 

Other 

Propeller 

A/C  In  Propeller 
Maintenance 

AOCP 

Day 

Generated 

Flown 

Hours 

Aborts 

Aborts 

Malfunctions 

Queue 

Propeller 

1 

30 

69 

0 

2 

3 

0 

0 

2 

36 

36 

76 

0 

2 

1 

0 

3 

3 

44 

44 

100 

0 

1 

4 

0 

1 

4 

38 

38 

85 

0 

2 

1 

0 

1 

5 

52 

52 

126 

0 

1 

2 

0 

1 

6 

0 

0 

0 

0 

0 

0 

0 

0 

7 

0 

0 

0 

0 

0 

0 

0 

0 

8 

36 

36 

85 

0 

1 

3 

0 

0 

9 

40 

40 

105 

0 

3 

3 

0 

0 

10 

30 

30 

77 

0 

1 

1 

0 

0 

11 

34 

34 

78 

0 

1 

2 

0 

0 

12 

38 

38 

86 

0 

3 

2 

0 

0 

13 

0 

0 

0 

0 

0 

0 

0 

0 

14 

0 

0 

0 

0 

0 

0 

0 

0 

15 

44 

44 

97 

1 

4 

3 

0 

0 

16 

26 

26 

61 

0 

1 

3 

0 

0 

17 

34 

34 

81 

0 

1 

0 

0 

0 

18 

34 

34 

77 

0 

1 

0 

0 

0 

19 

32 

32 

68 

0 

0 

2 

0 

0 

20 

0 

0 

0 

0 

0 

0 

0 

0 

21 

0 

0 

0 

0 

0 

0 

0 

0 

22 

42 

42 

96 

0 

1 

1 

0 

0 

23 

34 

34 

91 

0 

2 

1 

0 

0 

24 

32 

32 

71 

0 

2 

3 

0 

0 

25 

28 

28 

73 

0 

1 

3 

0 

0 

26 

44 

44 

126 

0 

2 

4 

0 

0 

27 

0 

0 

0 

0 

0 

0 

0 

0 

28 

0 

0 

0 

0 

0 

0 

0 

0 

29 

28 

28 

71 

0 

2 

4 

0 

0 

30 

40 

40 

83 

0 

1 

2 

0 

0 

I 

I 

I 

l 

l 

I 

I 

I 

] 

j 

J 

3 

3 

] 
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OF  SIMULATION  RUN  6 
Distribution  II 

are  the  same  as  for  the  basic  case. 


General  Maintenance 

Man-Hours  of 

Number  of  Propeller 

Man-Hours  of 

Number  of  General 

Propeller 

Maintenance 

A/C  in  General 

General 

Maintenance 

Maintenance 

Personnel 

Maintenance 

AOCP 

Maintenance 

Personnel 

Assigned 

Unassigned 

Queue 

General 

Assigned 

Unassigned 

61 

30 

0 

0 

828 

0 

12 

27 

0 

9 

761 

66 

28 

30 

0 

8 

551 

74 

10 

30 

0 

14 

1181 

78 

32 

30 

0 

12 

977 

43 

0 

30 

1 

10 

0 

16 

0 

30 

1 

9 

0 

85 

38 

30 

7 

3 

783 

100 

23 

27 

0 

6 

552 

77 

12 

30 

0 

14 

616 

77 

21 

30 

0 

10 

689 

79 

2 

30 

n 

10 

775 

71 

0 

30 

u 

7 

0 

77 

0 

30 

5 

2 

0 

100 

6 

30 

6 

1 

1009 

100 

25 

30 

0 

7 

566 

73 

0 

30 

0 

9 

560 

79 

0 

30 

0 

15 

641 

82 

2 

30 

0 

16 

931 

72 

0 

30 

0 

10 

0 

54 

0 

30 

5 

6 

0 

96 

12 

30 

7 

3 

876 

100 

0 

30 

0 

4 

533 

71 

13 

29 

0 

9 

566 

83 

14 

30 

0 

9 

564 

75 

26 

30 

0 

10 

670 

72 

0 

30 

0 

10 

0 

72 

0 

30 

3 

7 

0 

98 

24 

30 

4 

6 

591 

100 

3 

30 

0 

3 

587 

87 
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TABLE  14.  EVALUATION 


Average  Number  of  Missions  per 
Probability  of 

All  other  maintenance  parameters 


Operations 

Propeller  Maintenance 

Missions 

Missions 

Total 

Flying 

Propeller 

Other 

Propeller 

A/C  in  Propeller 
Maintenance 

AOCP 

Day 

Generated 

Flown 

Hours 

Aborts 

Aborts 

Malfunctions 

Queue 

Propeller 

1 

30 

82 

0 

1 

15 

0 

0 

2 

71 

54 

115 

1 

0 

32 

0 

2 

3 

67 

35 

90 

1 

2 

24 

0 

0 

4 

65 

34 

79 

0 

3 

18 

0 

1 

5 

63 

41 

86 

0 

2 

19 

0 

1 

6 

0 

22 

52 

0 

1 

13 

0 

1 

7 

0 

0 

0 

0 

0 

0 

0 

1 

8 

77 

57 

132 

0 

1 

32 

0 

1 

9 

56 

49 

115 

0 

2 

26 

0 

1 

10 

75 

36 

76 

0 

3 

14 

0 

3 

11 

£9 

39 

98 

0 

1 

19 

0 

0 

12 

63 

42 

100 

0 

3 

24 

0 

0 

13 

0 

21 

57 

0 

0 

14 

0 

0 

14 

0 

0 

0 

0 

0 

0 

0 

0 

15 

59 

49 

105 

0 

0 

23 

0 

0 

16 

77 

48 

95 

0 

1 

23 

0 

1 

17 

65 

44 

104 

0 

0 

24 

0 

0 

18 

59 

40 

100 

0 

1 

16 

0 

0 

19 

50 

43 

88 

0 

1 

20 

0 

0 

20 

0 

7 

13 

0 

1 

6 

0 

0 

21 

0 

0 

0 

0 

0 

0 

1 

0 

22 

67 

61 

149 

0 

4 

39 

1 

0 

23 

69 

43 

112 

0 

2 

20 

2 

0 

24 

59 

46 

93 

1 

0 

20 

0 

0 

25 

75 

44 

109 

1 

2 

24 

0 

0 

26 

56 

44 

95 

2 

1 

29 

0 

0 

27 

0 

12 

29 

1 

2 

7 

0 

0 

28 

0 

0 

0 

0 

0 

0 

0 

0 

29 

79 

73 

164 

0 

3 

48 

0 

0 

30 

61 

47 

98 

0 

1 

27 

0 

0 
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OF  SIMULATION  RUN  7 


Month  for  Aircraft  -  1480 

Propeller  Failure  -  0. 1 

are  the  same  as  for  the  basic  case. 


General  Maintenance 

Man-Hours  of 
Propeller 
Maintenance 
Assigned 

Number  of  Propeller 
Maintenance 

Personnel 

Unassigned 

A/C  in  General 
Maintenance 
Queue 

AOCP 

General 

Man-Hours  of 
General 

Maintenance 

Assigned 

Number  of  General 
Maintenance 

Personnel 

Unassigned 

76 

30 

0 

0 

796 

0 

105 

30 

0 

13 

1027 

66 

80 

9 

0 

16 

742 

27 

56 

9 

0 

16 

783 

26 

91 

17 

0 

15 

912 

37 

0 

12 

0 

10 

0 

14 

0 

30 

29 

4 

0 

92 

103 

30 

30 

3 

1759 

100 

86 

20 

0 

5 

990 

3 

28 

17 

0 

10 

623 

24 

118 

19 

1 

12 

761 

32 

69 

16 

0 

11 

812 

17 

0 

16 

0 

12 

0 

43 

0 

30 

24 

10 

0 

97 

159 

30 

26 

8 

1492 

100 

61 

12 

0 

10 

1083 

4 

87 

19 

0 

9 

809 

12 

48 

15 

1 

13 

697 

17 

65 

16 

0 

15 

732 

27 

0 

11 

0 

17 

0 

32 

0 

30 

10 

15 

0 

93 

157 

30 

16 

9 

1336 

100 

68 

9 

2 

12 

954 

20 

63 

15 

0 

10 

939 

14 

63 

17 

0 

12 

889 

14 

108 

11 

0 

11 

739 

15 

0 

10 

0 

11 

0 

30 

0 

30 

18 

8 

0 

100 

171 

30 

22 

4 

1456 

100 

97 

0 

0 

9 

832 

18 
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TABLE  15.  EVALUATION 


Average  Number  of 
Probability  of 
Repair  Time  - 
All  other  maintenance  parameters 


Operations 

Propeller  Maintenance 

Missions 

Missions 

Total 

Flying 

Propeller 

Other 

Propeller 

A/C  in  Propeller 
Maintenance 

AOCP 

Day 

Generated 

Flown 

Hours 

Aborts 

Aborts 

Malfunctions 

Queue 

Propeller 

1 

_  _ 

30 

80 

0 

5 

18 

0 

0 

2 

73 

0 

141 

1 

2 

32 

0 

2 

3 

67 

36 

74 

2 

0 

17 

0 

1 

4 

77 

44 

84 

0 

1 

26 

0 

1 

5 

67 

40 

92 

0 

1 

22 

0 

2 

6 

0 

23 

49 

0 

1 

13 

0 

1 

7 

0 

3 

3 

0 

0 

0 

0 

1 

8 

69 

57 

138 

0 

3 

27 

0 

1 

9 

65 

47 

110 

1 

3 

25 

0 

1 

10 

65 

42 

95 

2 

3 

23 

0 

0 

11 

69 

33 

87 

0 

0 

19 

0 

1 

12 

75 

32 

85 

0 

0 

27 

0 

0 

13 

0 

33 

80 

0 

3 

19 

1 

0 

14 

0 

5 

0 

0 

0 

0 

1 

0 

15 

65 

58 

129 

0 

2 

31 

1 

0 

16 

75 

45 

105 

0 

1 

24 

0 

0 

17 

56 

41 

93 

0 

2 

27 

0 

0 

18 

65 

41 

90 

0 

5 

21 

1 

0 

19 

50 

46 

105 

0 

0 

27 

0 

0 

20 

0 

4 

7 

0 

0 

3 

0 

0 

21 

0 

0 

0 

0 

0 

0 

0 

0 

22 

69 

68 

159 

0 

3 

44 

0 

0 

23 

73 

38 

118 

0 

2 

24 

0 

0 

24 

71 

36 

74 

0 

4 

24 

1 

0 

25 

50 

35 

79 

0 

2 

18 

0 

0 

26 

59 

32 

70 

1 

1 

18 

0 

0 

27 

0 

27 

58 

0 

2 

13 

0 

0 

28 

0 

0 

0 

0 

0 

0 

0 

0 

29 

53 

46 

102 

0 

1 

23 

0 

0 

30 

71 

52 

111 

1 

4 

30 

0 

0 
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OF  SIMULATION  RUN  8 


Missions  per  Month  -  1480 
Propeller  Failure  -  0.1 
Distribution  II 

are  the  same  as  for  the  basic  case. 


General  Maintenance 

Man-Hours  of 

Number  of  Propeller 

Man-Hours  of 

Number  of  General 

Propeller 

Maintenance 

A/C  in  General 

General 

Maintenance 

Maintenance 

Personnel 

Maintenance 

AOCP 

Maintenance 

Personnel 

Assigned 

Unassigned 

Queue 

General 

Assigned 

Unassigned 

151 

30 

0 

0 

571 

0 

221 

30 

0 

8 

1261 

82 

146 

8 

0 

11 

641 

17 

123 

13 

0 

14 

839 

32 

144 

11 

0 

14 

822 

23 

0 

2 

0 

16 

0 

23 

0 

30 

34 

6 

0 

90 

281 

30 

40 

3 

1782 

100 

156 

2 

0 

7 

1015 

8 

112 

0 

0 

8 

801 

16 

129 

20 

0 

13 

830 

26 

202 

10 

0 

9 

638 

23 

0 

5 

1 

5 

0 

15 

0 

30 

30 

6 

0 

100 

362 

30 

31 

5 

1474 

100 

128 

5 

0 

9 

898 

11 

169 

12 

0 

8 

639 

14 

137 

2 

1 

10 

838 

28 

229 

8 

0 

10 

859 

30 

0 

4 

0 

9 

0 

9 

0 

30 

8 

5 

0 

98 

272 

30 

13 

0 

1592 

100 

148 

0 

0 

6 

556 

18 

149 

2 

0 

10 

882 

27 

95 

5 

0 

9 

870 

26 

123 

14 

0 

12 

730 

31 

0 

12 

0 

9 

0 

23 

0 

30 

32 

6 

0 

96 

285 

30 

35 

3 

1877 

100 

164 

6 

0 

6 

970 

6 
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TABLE  16, 


EVALUATION  OF 


Average  Number  of  Missions 
Probability  of  Propeller 
Repair  Time  - 
All  other  maintenance  parameters 


Day 

Operations 

Propeller 

Malfunctions 

A/C  in 
Propeller 
Maintenance 
Queue 

Propeller 

AOCP 

Propeller 

Missions 

Generated 

Missions 

Flown 

Total 

Flying 

Hours 

Propeller 

Aborts 

Other  Aborts 

1 

. . 

30 

66 

0 

0 

17 

0 

0 

2 

73 

60 

137 

1 

3 

38 

0 

2 

3 

63 

32 

73 

1 

1 

19 

1 

0 

4 

65 

25 

64 

0 

4 

15 

1 

0 

5 

67 

32 

72 

0 

0 

21 

0 

0 

6 

0 

18 

62 

0 

1 

13 

0 

0 

7 

0 

1 

2 

0 

0 

0 

-  3 

0- 

8 

63 

29 

64 

0 

2 

19 

3 

0 

9 

71 

32 

64 

0 

2 

16 

1 

0 

10 

59 

39 

75 

0 

2 

24 

0 

0 

11 

56 

41 

117 

0 

1 

30 

1 

0 

12 

65 

24 

49 

0 

3 

13 

1 

1 

13 

0 

23 

41 

0 

2 

9 

1 

1 

14 

0 

0 

0 

0 

0 

0 

3 

1 

15 

56 

40 

92 

0 

2 

22 

2 

1 

16 

71 

39 

81 

0 

1 

22 

0 

0 

17 

71 

36 

69 

0 

4 

18 

0 

1 

18 

67 

40 

86 

0 

1 

19 

2 

0 

19 

65 

38 

80 

0 

1 

21 

0 

0 

20 

0 

18 

41 

0 

1 

12 

0 

1 

21 

0 

3 

11 

0 

0 

1 

0 

0 

22 

56 

38 

88 

0 

2 

22 

0 

0 

23 

56 

37 

86 

0 

1 

20 

0 

0 

24 

75 

41 

90 

0 

1 

20 

3 

0 

25 

73 

39 

78 

0 

3 

22 

1 

0 

26 

71 

39 

101 

0 

3 

19 

1 

0 

27 

0 

24 

59 

1 

1 

16 

2 

0 

28 

0 

0 

0 

0 

0 

0 

2 

0 

29 

15 

40 

94 

0 

5 

24 

1 

0 

30 

77 

32 

97 

1 

1 

22 

0 

0 
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SIMULATION  RUN  9 


per  Month  for  Aircraft  -  1480 

Failure  -  0. 1 

Distribution  in  III 

are  the  tame  as  for  the  basic  case 


Maintenance 

General  Maintenance 

Man  Hours  of 
Propeller 
Maintenance 
Assigned 

Number  of  Propeller 
Maintenance 

Personnel 

Unassigned 

A/C  in  General 
Maintenance 
Queue 

AOCP 

General 

Man  Hours  of 
General 
Maintenance 
Assigned 

Number  of  General 
Maintenance 

Personnel 

Unassigned 

588 

30 

0 

0 

767 

0 

654 

2 

0 

5 

1276 

82 

454 

0 

0 

6 

729 

27 

229 

0 

0 

9 

557 

40 

493 

2 

0 

14 

693 

47 

0 

0 

0 

11 

0 

32 

0 

30 

18 

12 

0 

96 

1015 

30 

23 

8 

1013 

100 

261 

0 

1 

7 

843 

39 

313 

0 

0 

4 

561 

32 

620 

0 

0 

9 

654 

43 

364 

0 

0 

13 

571 

44 

0 

0 

0 

11 

0 

44 

0 

27 

28 

9 

0 

97 

624 

27 

32 

4 

1304 

100 

596 

0 

0 

5 

568 

31 

330 

1 

0 

8 

608 

25 

408 

0 

0 

9 

671 

38 

572 

1 

0 

12 

830 

27 

0 

0 

0 

13 

0 

39 

0 

30 

26 

6 

0 

89 

692 

30 

29 

6 

1090 

100 

477 

0 

0 

7 

823 

24 

568 

0 

1 

8 

600 

30 

391 

1 

2 

9 

737 

34 

389 

0 

0 

10 

817 

34 

0 

0 

0 

12 

0 

24 

0 

30 

25 

13 

0 

99 

616 

30 

32 

6 

1218 

100 

422 

0 

0 

7 

970 

32 
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TABLE  17.  EVALUATION  OF 

Average  Number  of  Miwiom 
fviis&iooi  Duration  - 
Probability  of  Propeller 
Repair  Time  - 
All  other  maintenance  parameters  are 


Day 

Operations 

Propeller 

Malfunctions 

A/C  in 
Propeller 
Maintenance 
Queue 

Propeller 

AOCP 

Propeller 

Missions 

Generated 

Missions 

Flown 

Total 

Flying 

Hours 

Propeller 

Aborts 

Other  Aborts 

1 

„  _ 

30 

180 

0 

2 

27 

0 

0 

2 

73 

39 

234 

0 

0 

34 

0 

2 

3 

50 

36 

216 

0 

2 

31 

3 

0 

4 

69 

22 

132 

0 

1 

21 

5 

3 

5 

79 

26 

156 

0 

1 

23 

0 

1 

6 

0 

14 

84 

0 

0 

10 

1 

1 

7 

0 

1 

6 

0 

0 

1 

1 

0 

8 

69 

28 

168 

0 

2 

25 

0 

0 

9 

81 

24 

144 

0 

2 

22 

2 

0 

10 

69 

26 

156 

0 

2 

25 

0 

1 

11 

67 

22 

132 

0 

1 

21 

6 

1 

12 

65 

19 

114 

1 

0 

18 

5 

0 

13 

0 

13 

78 

0 

0 

12 

2 

0 

14 

0 

0 

0 

0 

0 

0 

5 

0 

15 

61 

22 

132 

0 

1 

19 

3 

0 

16 

71 

18 

108 

0 

1 

16 

1 

1 

17 

73 

24 

144 

0 

0 

23 

4 

0 

18 

53 

22 

132 

0 

0 

16 

2 

0 

19 

73 

30 

180 

0 

1 

27 

4 

0 

20 

0 

13 

78 

0 

1 

13 

3 

0 

21 

0 

1 

6 

0 

0 

1 

4 

0 

22 

56 

22 

132 

0 

0 

21 

2 

0 

23 

71 

29 

174 

0 

1 

26 

3 

0 

24 

69 

30 

180 

0 

1 

25 

2 

0 

25 

67 

26 

156 

0 

1 

26 

4 

0 

26 

69 

21 

126 

0 

2 

20 

6 

1 

27 

0 

11 

66 

0 

1 

11 

0 

1 

28 

0 

1 

6 

0 

0 

0 

1 

2 

29 

73 

29 

174 

0 

2 

27 

1 

1 

30 

75 

25 

150 

0 

0 

22 

2 

1 

I 

I 

J 

J 

] 

] 

] 


WADC  TR  59-106 


166 


SIMULATION  RUN  10 


per  Month  -  1480 
6  Hours  (Fixed) 

Failure  -  0. 1 
Distribution  Ill 

the  same  as  for  the  basic  case. 


Maintenance 

General  Maintenance 

Man-Hours  of 
Propeller 
Maintenance 
Assigned 

Number  of  Propeller 
Maintenance 
Personnel 
Unassigned 

A/C  in  General 
Maintenance 
Queue 

AOCP 

General 

Man-Hours  of 
Genaal 

Maintenance 

Assigned 

Number  of  General 
Maintenance 

Personnel 

Unassigned 

605 

30 

0 

0 

834 

0 

656 

0 

0 

7 

944 

57 

534 

0 

4 

2 

552 

15 

372 

0 

7 

6 

570 

27 

475 

0 

0 

7 

463 

39 

0 

0 

1 

7 

0 

42 

0 

30 

15 

5 

0 

93 

1690 

30 

19 

2 

827 

100 

502 

0 

1 

5 

473 

41 

488 

0 

0 

4 

546 

56 

376 

0 

5 

6 

310 

44 

343 

1 

0 

8 

441 

62 

0 

0 

1 

6 

0 

51 

0 

30 

13 

7 

0 

94 

609 

30 

16 

4 

924 

100 

348 

0 

2 

3 

405 

33 

340 

0 

1 

6 

499 

42 

216 

0 

0 

5 

356 

52 

558 

0 

3 

7 

521 

58 

0 

0 

1 

8 

0 

31 

0 

30 

12 

9 

768 

96 

721 

30 

0 

5 

0 

43 

369 

0 

16 

6 

578 

100 

587 

0 

1 

5 

532 

37 

554 

0 

2  - 

8 

492 

41 

477 

0 

3 

11 

229 

53 

0 

1 

0 

11 

0 

57 

0 

30 

14 

9 

0 

99 

744 

30 

21 

3 

886 

100 

564 

0 

3 

2 

336 

40 
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TABLE  18.  EVALUATION  OF 


Mission  Duration  - 
Repair  Time  - 
Propeller  Maintenance 


Day 

Operations 

Propeller 

Malfunctions 

A/C  in 
Propeller 
Maintenance 
Queue 

Propeller 

AOCP 

Propeller 

Missions 

Generated 

Missions 

Flown 

Total 

Flying 

Hours 

Propeller 

Aborts 

Other  Aborts 

1 

.. 

30 

180 

1 

0 

2 

0 

0 

2 

36 

36 

216 

0 

1 

7 

0 

2 

3 

30 

30 

180 

0 

2 

5 

0 

0 

4 

32 

32 

192 

0 

1 

11 

0 

0 

5 

34 

34 

204 

0 

1 

5 

0 

0 

6 

0 

0 

0 

0 

0 

0 

0 

0 

7 

0 

0 

0 

0 

0 

0 

0 

0 

8 

36 

36 

216 

1 

0 

9 

0 

0 

9 

38 

38 

228 

0 

1 

7 

0 

0 

10 

26 

26 

156 

0 

2 

6 

0 

0 

11 

32 

32 

192 

0 

3 

10 

0 

0 

12 

24 

24 

144 

0 

3 

8 

0 

0 

13 

0 

0 

0 

0 

0 

0 

0 

0 

14 

0 

0 

0 

0 

r  0 

0 

0 

0 

15 

42 

42 

252 

0 

6 

0 

0 

16 

36 

36 

216 

0 

1 

5 

0 

0 

17 

44 

44 

264 

0 

3 

6 

0 

0 

18 

34 

34 

204 

0 

0 

4 

0 

0 

19 

40 

40 

240 

0 

1 

4 

0 

0 

20 

0 

0 

0 

0 

0 

0 

0 

0 

21 

0 

0 

0 

0 

0 

0 

0 

0 

22 

20 

20 

120 

0 

1 

4 

0 

0 

23 

22 

22 

132 

0 

2 

5 

0 

0 

24 

28 

28 

168 

0 

1 

3 

0 

0 

25 

40 

40 

240 

1 

3 

6 

0 

0 

26 

36 

36 

216 

0 

1 

5 

0 

0 

27 

0 

0 

0 

0 

0 

0 

0 

0 

28 

0 

0 

0 

0 

0 

0 

0 

0 

29 

32 

32 

192 

0 

3 

3 

0 

0 

30 

44 

44 

264 

0 

0 

12 

0 

0 
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SIMULATION  RUN  11 


6  Hour*  (Fixed) 
Distribution  HI 
Personnel  -  15 


Maintenance 

General  Maintenance 

. .  ---  ■■■ 

Man-Hours  of  Number  of  Propeller 
Propeller  Maintenance 

Maintenance  Personnel 

Assigned  Unassigned 

A/C  in  General 
Maintenance 
Queue 

AOCP 

General 

Man-Hours  of 
General 

Maintenance 

Assigned 

Number  of  General 
Maintenance 
Personnel 
Unassigned 

62 

30 

0 

0 

838 

0 

255 

12 

0 

7 

698 

68 

125 

1 

0 

8 

663 

63 

335 

4 

0 

9 

502 

54 

107 

0 

0 

6 

727 

61 

0 

0 

0 

8 

0 

51 

0 

15 

2 

6 

0 

96 

328 

15 

5 

3 

615 

100 

266 

1 

0 

4 

520 

86 

52 

3 

0 

8 

514 

74 

237 

3 

0 

6 

570 

73 

84 

1 

0 

8 

519 

69 

0 

5 

0 

7 

0 

70 

0 

15 

2 

5 

0 

100 

100 

15 

2 

5 

687 

100 

115 

8 

0 

9 

1036 

70 

184 

5 

0 

5 

728 

51 

64 

0 

0 

11 

463 

39 

168 

9 

0 

10 

758 

52 

0 

1 

0 

12 

0 

39 

0 

15 

1 

11 

0 

100 

112 

15 

6 

6 

426 

100 

118 

7 

0 

6 

436 

76 

56 

3 

0 

3 

485 

83 

54 

11 

0 

5 

717 

74 

105 

12 

0 

9 

686 

58 

0 

4 

0 

8 

0 

53 

0 

15 

2 

6 

0 

94 

139 

15 

6 

2 

496 

100 

243 

2 

0 

6 

641 

78 
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TABLE  19.  EVALUATION  OF 


Mission  Duration  - 
Probability  of  Propeller 
Repair  Time  - 
Propeller  Maintenance 


Day 

Operations 

Propeller 

Malfunctions 

A/C  in 
Propeller 
Maintenance 
Queue 

Propeller 

AOCP 

Propeller 

Missions 

Generated 

Missions 

Flown 

Total 

Flying 

Hours 

Propeller 

Aborts 

Other  Aborts 

1 

.. 

30 

180 

1 

3 

26 

0 

0 

2 

30 

29 

174 

1 

1 

27 

2 

5 

3 

36 

17 

102 

0 

2 

16 

2 

3 

4 

28 

15 

90 

0 

1 

15 

2 

2 

5 

36 

15 

90 

0 

1 

13 

3 

1 

6 

1 

7 

42 

f\ 

1 

7 

4 

2 

7 

0 

0 

0 

0 

0 

0 

4 

0 

8 

36 

13 

78 

0 

1 

12 

4 

0 

9 

34 

16 

96 

0 

0 

15 

1 

1 

10 

32 

14 

84 

0 

1 

13 

6 

0 

11 

42 

14 

84 

0 

1 

13 

4 

0 

12 

34 

20 

120 

0 

1 

18 

4 

0 

13 

0 

10 

60 

0 

0 

10 

1 

0 

14 

0 

0 

0 

0 

0 

0 

3 

0 

15 

32 

13 

78 

0 

0 

12 

2 

0 

16 

40 

17 

102 

0 

1 

17 

4 

0 

17 

40 

12 

72 

0 

0 

10 

5 

0 

18 

22 

14 

84 

0 

0 

11 

7 

0 

19 

38 

10 

60 

0 

1 

10 

7 

0 

20 

0 

6 

36 

0 

0 

5 

4 

0 

21 

0 

0 

0 

0 

0 

0 

3 

0 

22 

40 

13 

78 

0 

1 

11 

2 

0 

23 

34 

17 

102 

0 

0 

15 

2 

1 

24 

30 

11 

66 

0 

0 

11 

1 

1 

25 

36 

13 

78 

0 

0 

12 

2 

0 

26 

38 

13 

77 

0 

0 

10 

3 

0 

27 

0 

10 

60 

1 

0 

9 

1 

0 

28 

0 

0 

0 

0 

0 

0 

1 

0 

29 

38 

12 

72 

0 

0 

12 

1 

0 

30 

32 

12 

72 

0 

0 

12 

2 

0 
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SIMULATION  RUN  12 

6  Hours  (Fixed} 
Failure  -  0.1 
Distribution  III 
Personnel  -  15 


Maintenance 

General  Maintenance 

Man-Hours  of  Number  of  Propeller 
Propeller  Maintenance 

Maintenance  Personnel 

Assigned  Unassigned 

A/C  in  General 
Maintenance 
Queue 

AOCP 

General 

Man-Hours  of 
General 

Maintenance 

Assigned 

Number  of  General 
Maintenance 
Personnel 
Unassigned 

573 

30 

0 

0 

715 

0 

496 

0 

0 

11 

599 

58 

337 

0 

0 

9 

476 

49 

258 

0 

1 

8 

301 

50 

307 

0 

1 

6 

192 

54 

0 

0 

1 

8 

0 

72 

0 

15 

11 

5 

0 

100 

420 

15 

12 

4 

452 

100 

291 

0 

0 

3 

191 

68 

200 

0 

1 

7 

343 

66 

296 

0 

2 

7 

395 

71 

273 

0 

2 

6 

457 

10 

0 

0 

0 

6 

0 

38 

0 

15 

11 

5 

0 

98 

471 

15 

13 

3 

590 

100 

513 

0 

0 

5 

319 

71 

198 

0 

0 

5 

198 

64 

278 

0 

1 

7 

265 

72 

90 

0 

0 

10 

241 

70 

0 

0 

0 

8 

0 

77 

0 

15 

9 

5 

0 

96 

313 

15 

12 

2 

476 

100 

201 

1 

o 

3 

259 

74 

246 

0 

1 

4 

265 

73 

232 

0 

,  0 

3 

396 

71 

141 

0 

1 

3 

263 

59 

0 

0 

1 

1 

0 

69 

0 

15 

10 

1 

0 

95 

451 

15 

10 

1 

340 

100 

263 

0 

0 

2 

203 

71 
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maintenance  queue.  The  relative  burden  of  propeller  maintenance  is  high  in 
comparison  with  the  general  maintenance.  Propeller  reliability  in  this  case 
has  a  significant  influence  on  unit  operational  capability. 

In  all  three  cases,  the  number  of  missions  flown  is  indicative  of  the 
maximum  capability  of  the  unit  under  the  specified  conditions.  In  Simula¬ 
tion  Runs  7  and  8  (Tables  14  and  15),  the  unit  is  able  to  accomplish  approxi¬ 
mately  1,030  missions.  However,  under  the  more  stringent  propeller  re¬ 
pair  requirement  in  Simulation  Run  9  (Table  16),  the  unit  is  able  to  accom¬ 
plish  only  850  missions.  Since  the  only  parameter  varied  in  these  three 
cases  is  the  propeller  repair  time  requirement,  the  reduction  in  mission 
capability  can  be  attributed  directly  to  propeller  reliability. 

In  the  simulation  shown  in  Table  17,  the  operational  conditions  are  the 
same  as  those  for  Table  16  except  the  mission  duration  is  now  assumed  to  be 
6  hours  for  all  flights.  The  propeller  maintenance  activity  in  this  case  is 
considerably  over  stressed,  even  on  the  two -shift  basis.  The  number  of  air¬ 
craft  awaiting  maintenance  in  the  propeller  queue  indicates  that  this  condi¬ 
tion  would  induce  a  severe  availability  problem.  The  operational  capability 
of  the  unit  is  now  reduced  to  only  594  missions  in  the  30-day  period. 

The  final  simulation  runs.  Runs  11  and  12,  are  presented  in  Tables  18 
and  19.  These  two  cases  compare  the  effects  of  low  and  high  probability  of 
propeller  malfunction  when  the  propeller  maintenance  force  is  only  half  its 
previous  size,  or  15  men.  Other  conditions  include  an  average  flying  load 
of  740  missions  per  month,  each  of  6  hours1  duration,  and  the  most 
stringent  case  for  propeller  maintenance  time. 

In  Table  18,  the  maintenance  force  is  almost  fully  utilized  in  accomp¬ 
lishing  the  736  missions  actually  flown.  The  operational  capability  of  the 
unit  is  sufficient  to  accomplish  all  missions  assigned.  Reliability  of  the 
propeller  is  acceptable,  but  malfunctions  that  do  occur  are  difficult  to  re¬ 
pair.  In  Table  19,  when  the  failure  rate  is  increased  to  a  probability  of 
0.  1  per  hour,  the  propeller  maintenance  force  is  not  sufficient.  Aircraft 
waiting  in  the  propeller  maintenance  queue  are  largely  responsible  for  the 
decline  in  unit  capability.  The  unit  is  able  to  accomplish  only  343  missions. 
This  situation  might  be  viewed  as  a  detached  unit  operation,  and  indicates 
the  effect  of  propeller  reliability  under  conditions  of  limited  maintenance. 


Description  of  the  Digital  Computer  Program  Used  to 
Determine  the  Disposition  of  Aircraft  During 
a  Period  of  Operations 


The  program  for  digital  computation  was  prepared  for  the  purpose  of 
analyzing  the  operations  of  a  unit  with  a  complement  of  50  turboprop  aircraft 
for  a  period  of,  say,  30  days  when  the  change  of  aircraft  disposition  is 
considered  on  an  hourly  basis.  The  computer  program  is  best  described  by 


i 

i 

i 

i 

] 
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the  flow  of  information  through  the  computer.  Flow  chart  illustrations 
shown  in  Figures  41  through  46  present,  in  simplified  form,  the  sequence  of 
events  that  has  been  converted  to  machine  instructions.  These  flow  charts 
will  be  described  as  they  are  introduced  in  the  discussion. 

The  flow  of  information  was  developed  from  a  mathematical  representa¬ 
tion  of  the  several  events  of  the  operational  sequence.  The  model  is  based 
upon  the  underlying  assumptions  previously  discussed.  Most  of  the  compu¬ 
tational  routines  consist  of  a  simple  accounting  of  time,  aircraft,  men,  and 
missions.  When  random  events  are  considered,  it  is  necessary  to  employ 
Monte  Carlo  techniques.  Random  numbers  are  generated  and  are  used  as 
the  arguments  for  entries  to  tables  containing  the  appropriate  functional 
values  stored  in  the  computer  memory.  This  technique  is  employed  to 
determine  functional  values  for  the  following: 

(1)  The  mission  requirements  generated  during  each  day  of 
operations  (Table  6) 

(2)  The  duration  of  the  mission  to  be  flown  (Table  6) 

(3)  Whether  or  not  a  mission  is  aborted 

(4)  Whether  there  is  a  propeller  failure 

(5)  Frequency  and  duration  of  AOCP  (general  and/or  pro¬ 
peller,  Table  7) 

(6)  The  man-hours  and  the  number  of  men  required  for 
general  and  propeller  maintenance  (Tables  8  and  9). 

The  following  conventions  are  used  in  the  discussion  of  the  program 
and  in  the  flow  charts: 

a/c  Aircraft 

AOCP  Aircraft  out -of -commission,  parts 

A  A  point  in  the  program  where  alternative  courses  of 
^  action  can  be  followed 

Q  Interconnecting,  entry,  or  exit  points  in  the  program. 


Representation  of  the  Simulation  by  the  Computer  Program 


The  following  discussion  presents  the  essential  details  of  the  com¬ 
puter  program  used  to  simulate  the  operational  sequence  of  events. 
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Starting  the  Program 


At  the  beginning  of  each  hour  and/or  day,  and  at  the  initial  start  of  the 
program,  a  group  of  calculations  are  performed  before  referring  to  any 
particular  aircraft.  In  Figure  41,  the  first  step  in  the  computations  is  to 
take  the  number  of  missions  aborted  during  the  preceding  hour  and  add  these 
to  the  number  of  unassigned  missions  remaining  for  the  particular  day. 

Note  that  these  missions  are  not  identified  by  length  at  this  point,  A  certain 
number  of  missions  are  preassigned  as  an  initial  condition  for  the  computa¬ 
tion.  At  0800  of  each  succeeding  day,  a  Monte  Carlo  method  is  used  to  de¬ 
termine  the  number  of  new  missions  generated  for  the  day's  operations. 

To  obtain  the  daily  mission  requirements,  the  random  number  argu¬ 
ment  is  used  to  enter  a  stored  table  with  functional  values  obtained  as  dis¬ 
cussed  below.  The  number  of  missions  obtained  is  based  on  the  assumption 
that  a  certain  number  of  missions  are  flown  each  month.  An  average  value 
for  normal  operation  is  taken  to  be  740  missions.  A  value  of  1480  missions 
can  be  used  to  study  the  effect  of  a  doubled  mission  requirement.  One 
method  of  realizing  this  number  of  missions  is  to  derive  a  probability  of 
flight  of  an  aircraft  for  each  hour  of  operations  and  then  perform  a  separate 
Monte  Carlo  each  time  an  aircraft  is  found  available.  However,  this 
laborious  process  can  be  avoided,  since  the  individual  probabilities  are  low 
and  repetition  of  the  process  a  large  number  of  times  would  be  expected  for 
an  operational  period  of  30  days.  Therefore,  it  is  possible  to  use  Poisson's 
exponential  binomial  limit  in  the  form: 

P  (flights)  =  e~.NP(Ng)k  , 

ki 

wherein  the  terms  have  the  following  definitions: 

N  Number  of  aircraft  (50) 

p  Probability  of  flight  of  each  aircraft  during  a  24 -hour 
period 

k  Number  of  missions  generated  for  24  hours  of  operations. 

For  the  740-  and  1480-mission  cases,  Np  is  found  to  be  33  and  66, 
respectively.  In  the  first  case,  the  probability  of  occurrence  is  not  greater 
than  or  equal  to  0.0001  until  k  equals  14.  Only  four  significant  digits  are 
used  in  the  Monte  Carlo  process  employed,  and  14  is  the  least  number  of 
missions  generated  for  a  day's  operations.  Also,  when  k  exceeds  56,  the 
probability  again  becomes  less  than  0.0001,  and  56  is  the  maximum  number 
of  missions  generated.  The  corresponding  numbers  for  the  1480-mission 
case  are  40  and  93,  The  relative  frequencies  used  are  found  in  published 
tables.  ( 1) 

(1)  Molina,  E,  C, ,  Poiison's  Exponential  Binomial  Limit,  D,  Van  Nostrand  Company,  Inc,  9  New  York  (1942), 


WADC  TR  59-106 


174 


«WW!W. 


WADC  TR  59-106 


175 


FIGURE  41.  START  OF  PROGRAM  FOR  ANALYSIS  OF  AIRCRAFT  DISPOSITION 


New  missions  are  generated  on  the  first  5  days  of  the  week  only.  The 
mission  backlog  is  cancelled  at  0800  of  each  week  day  to  prevent  an  unrealis¬ 
tic  accumulation  of  backlog  missions.  On  the  6th  and  7th  days  (week  ends), 
the  mission  backlog  remaining  from  the  5th  day's  (Friday)  operations  is 
flown.  This  represents  a  reduced  operational  effort  for  Saturday  and 
Sunday.  When  the  30-day  period  of  interest  has  elapsed,  the  simulation  is 
halted. 

The  output  (or  punch)  instructions  are  also  found  in  this  block.  The 
data  output  at  0800  of  each  day  is  as  follows: 

(1)  Day 

(2)  Number  of  new  missions  generated  for  day's  operations 

(3)  Number  of  missions  generated  at  0800  of  preceding  day 
but  not  flown  by  0800  of  current  day 

(4)  Number  of  missions  aborted  during  preceding  24  hours 
because  of  propeller  failures 

(5)  Number  of  missions  aborted  during  preceding  24  hours 
because  of  nonpropeller  failures 

(6)  Number  of  propeller  failures  (in  flight)  during  preceding 
24  hours 

(7)  Man-hours  of  propeller  maintenance  work  in  progress  but 
not  completed 

(8)  Man-hours  of  general  maintenance  work  in  progress  but 
not  completed 

(9)  Number  of  aircraft  in  general  maintenance  queue 

(10)  Number  of  aircraft  in  propeller  maintenance  queue 

(11)  Number  of  aircraft  AOCP  (propeller) 

(12)  Number  of  aircraft  AOCP  (general  maintenance) 

(13)  Man-hours  of  general  maintenance  work  assigned  during 
preceding  24  hours 

(14)  Man-hours  of  propeller  maintenance  work  assigned  during 
preceding  24  hours 

(15)  Total  number  of  aircraft  hours  available,  i.e.  ,  sum  of 
aircraft  available  for  each  of  preceding  24  hours 
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(16)  Total  number  of  flight  hours  during  preceding  24  hours 

(17)  Unassigned  general  maintenance  men 

(18)  Unassigned  propeller  maintenance  men 

(19)  Total  flight  time  of  each  aircraft. 

The  output  is  designed  to  make  available  the  most  significant  aspects  of  a 
day^s  operations. 

Computational  methods  are  not  shown  in  the  flow  charts,  since  this 
unnecessarily  complicates  the  presentation  and  only  some  simple  book¬ 
keeping  is  involved.  A  tally  is  kept  of  the  number  of  missions  aborted 
during  the  preceding  24  hours,  and,  after  these  data  are  punched,  the  com¬ 
puter  memory  location  in  which  the  tally  is  stored  is  reset  to  zero  to  start 
a  new  count  for  the  next  24  hours  of  operations. 


Processing  of  Individual  Aircraft 
(A/C)  Records 


The  entry  FIRST  A/C  refers  to  the  first  aircraft  record,  this  being  the 
exit  from  the  "START11  flow  chart  (Figure  38).  The  first  aircraft  record  is 
examined  to  determine  the  category  of  the  aircraft  and,  where  applicable, 
the  time  the  aircraft  must  remain  in  that  category.  The  category  and  the 
time  to  remain  therein  determine  the  disposition  of  the  aircraft  during  the 
next  hour.  The  flow  charts  in  Figures  41  through  46  are  concerned  with  the 
processing  of  individual  aircraft  records.  After  the  records  of  all  50  air¬ 
craft  have  been  processed,  the  computer  program  returns  to  the  "START" 
block  to  compute  the  events  of  the  next  hour.  The  primary  categories  in 
which  aircraft  are  placed  are  as  follows: 

(1)  Available  for  flying  a  mission 

(2)  Inflight 

(3)  In  flight  with  a  propeller  failure 

(4)  AOCP  for  parts  required  in  general  maintenance 

(5)  AOCP  for  parts  required  in  general  maintenance,  and  with 
a  propeller  also  in  maintenance  channels 

(6)  In  the  general  maintenance  queue 

(7)  In  the  general  maintenance  queue,  and  with  a  propeller 
also  in  maintenance  channels 
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Monte  Carlo  to  de-  Use  length  of  mission  to 
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FIGURE  42.  ASSIGNMENT  OF  AVAILABLE  AIRCRAFT 


FIGURE  43.  ASSIGNMENT  OF  AIRCRAFT  RETURNING  FROM  FLIGHT 


*  When  time  in  AOCP  is  completed,  aircraft  is  transferred  to  appropriate  queue. 


FIGURE  44.  START  OF  MAINTENANCE  CHANNELS 
(PROPELLER  AND  GENERAL) 
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FIGURE  46.  AIRCRAFT  IN  MAINTENANCE  (GENERAL  AND  PROPELLER) 
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(8)  In  general  maintenance 

(9)  In  general  maintenance  and  with  a  propeller  in  main¬ 
tenance  channels  also 

(10)  General  maintenance  completed,  but  with  a  propeller 
remaining  in  maintenance  channels 

(11)  Undergoing  periodic  inspection  (150-  or  300-hour  check). 

These  categories  are  inclusive.  Each  aircraft  must  always  be  present 
in  one  of  the  above  categories.  However,  if  propeller  maintenance  is  being 
performed,  an  aircraft  can  also  be  present  in  one  of  the  following  additional 
(secondary)  categories: 

(1)  AOCP  for  parts  required  in  propeller  maintenance 

(2)  In  the  propeller  maintenance  queue 

(3)  In  propeller  maintenance 

(4)  Propeller  maintenance  completed,  but  still  in  general 
maintenance  channels. 

Individual  aircraft  records  also  carry  information  on  the  time  to  re¬ 
main  in  the  primary  and  secondary  categories,  the  number  of  men  assigned 
for  both  general  and  propeller  maintenance,  the  total  flight  hours,  and 
whether  or  not  the  150 -hour  check  has  been  completed. 


Processing  of  Available  Aircraft.  Available  aircraft  records  are 
processed  according  to  Figure  39.  However,  if  there  is  no  mission  backlog, 
the  aircraft  record  is  not  processed,  and  the  computation  proceeds  to  the 
next  aircraft  record.  It  should  be  noted  here  that  at  any  point  in  the  flow 
charts  where  NEXT  A/C  is  indicated,  the  processing  of  a  particular  air¬ 
craft  record  is  complete  for  that  hour.  The  next  aircraft  record  is  then 
considered,  and  this  process  repeated  for  each  aircraft  in  each  hour. 

When  missions  are  to  be  flown,  the  Monte  Carlo  technique  is  used  to 
determine  whether  the  mission  is  aborted.  This  is  accomplished  by  generat¬ 
ing  a  four -digit  random  number,  ascertaining  whether  this  number  is  less 
than  a  given  value,  say,  0500,  and,  if  so,  the  mission  is  regarded  as 
aborted.  In  this  example,  abort  rate  would  be  equivalent  to  5  per  cent. 

The  random  number  is  also  compared  with  a  smaller  number,  say  0050,  and, 
if  less  than  this,  the  abort  is  considered  due  to  a  propeller  malfunction. 

The  implication  here  is  that  4.  5  per  cent  of  the  missions  are  aborted  because 
of  general  malfunctions  and  the  other  0.5  per  cent  are  propeller  aborts. 

Note  that,  for  simplification  in  record  keeping,  the  length  of  the  mission  has 
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not  yet  been  determined.  An  aborted  mission  is  not  identified  as  to  length, 
and  does  not  accrue  flying  time. 

The  Monte  Carlo  technique  is  next  applied  to  determine  the  length  of 
the  mission.  The  relative  frequencies  of  various  mission  lengths  found  in 
Table  20  are  based  on  actual  flight  records.  The  generated  length  of  the 
mission  is  used  to  establish  the  probability  of  propeller  failure.  Although 
four  propellers  are  under  consideration,  it  is  assumed  that  only  one  failure 
will  occur  per  flight.  This  is  not  considered  too  severe  an  assumption, 
since  multiple  failures  are  relatively  infrequent  in  actual  operations,  and 
they  should  therefore  not  greatly  disturb  the  over -all  propeller  maintenance 
activities  generated  by  single  failures.  To  obtain  the  probability  of  a  pro¬ 
peller  failure  for  the  aircraft  in  flight,  the  individual  propeller  failure 
probability  is  multiplied  by  4,  so  that  all  propellers  are  considered.  The 
probability  of  failure  is  assumed  to  be  exponential  and  is  determined  by  the 
expression: 


wherein  a  is  the  hazard  rate  for  four  propellers  per  hour  of  flight,  and  t  is 
the  duration  of  the  flight.  A  random  selection  is  made  to  see  whether  the 
failure  is  realized.  The  two  values  of  a  used  in  this  study  were  (4  x  0.  008), 
or  0.  032,  and  (4  x  0.  1),  or  0.4.  The  first  value  reflects  specific  operational 
experience  with  turboprop  aircraft.  After  determining  whether  there  is  a 
propeller  failure,  the  aircraft  being  considered  is  placed  in  in-flight  status 
for  the  duration  of  the  flight  and  is  aged  accordingly. 

TABLE  20.  RELATIVE  FREQUENCIES  OF 
VARIOUS  MISSION  LENGTHS 


Mission  Length, 
hours 

Relative 

Frequency 

1 

0.3652 

2 

0. 2767 

3 

0. 1586 

4 

0. 1197 

5 

0. 0496 

6 

0.0301 

Processing  of  In-Flight  Aircraft.  When  a  flight  is  completed,  the 
aircraft  record  is  processed  as  indicated  in  Figure  40.  Aircraft  age  is 
checked  to  see  whether  either  the  150-hour  or  the  300-hour  periodic  inspec¬ 
tion  is  required.  If  the  300-hour  check  is  due,  the  aircraft  is  placed  in  the 
periodic  inspection  category  for  a  period  of  5  days  and  then  returned  to  the 
available  list  with  its  flight  time  reset  to  zero.  For  the  150-hour  check, 
the  same  is  done,  but  for  1  day  only,  and  the  total  flight  time  is  not  reset. 
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If  inspection  is  not  due,  the  aircraft  record  is  processed  through  the  MAIN¬ 
TENANCE  CHANNEL-GENERAL  or  both  the  MAINTENANCE  CHANNEL- 
GENERAL  AND  MAINTENANCE  CHANNEL -PROPELLER  (Figure  41),  de¬ 
pending  on  whether  or  not  a  propeller  failure  has  occurred. 

It  should  be  noted  here  that  all  aircraft  returning  from  a  flight  require 
some  general  maintenance.  If  a  propeller  failure  has  occurred,  or  if  the 
mission  was  aborted  because  of  a  propeller  malfunction,  the  aircraft  is  re¬ 
quired  to  enter  both  maintenance  channels,  and  it  is  not  released  to  available 
status  until  both  types  of  maintenance  have  been  completed.  The  processing 
through  both  channels  is  simultaneous  but  not  parallel.  One  type  of  main¬ 
tenance  may  be  completed  before  the  other,  e.  g.  ,  an  aircraft  may  be  AOCP 
(propeller)  while  the  general  maintenance  work  is  being  performed. 


Processing  of  Aircraft  in  Propeller  and 
General  Maintenance  Channels 


Upon  entering  propeller  maintenance  channels  (Figure  41),  a  random- 
number  comparison  determines  the  occurrence  and  duration  of  an  AOCP. 

The  number  of  hours  AOCP  is  based  upon  a  Poisson  distribution  of  time 
duration  us  i:^g  .discrete  12 -hour  intervals  and  a  most  probable  value  of  72 
hours  (Table  21).  If  AOCP  time  is  zero,  the  aircraft  is  placed  in  the  pro¬ 
peller  maintenance  queue  until  the  next  computational  cycle  at  the  next  hour. 
The  next  step  is  to  determine  whether  there  is  an  AOCP  in  general  main¬ 
tenance.  This  is  done  on  the  same  basis  as  for  the  propeller.  Again,  if 
AOCP  is  zero,  the  aircraft  is  placed  in  the  general  maintenance  queue. 

Note  in  Figure  41  that  aircraft  without  propeller  malfunctions  are  processed 
only  through  the  entry  point  MAINTENANCE  CHANNEL  (GENERAL). 


Processing  of  Aircraft  in  the  Maintenance  Queues.  Aircraft  in  the 
maintenance  queues  (general  or  propeller)  are  processed  as  shown  in 
Figure  42.  The  number  of  maintenance  man-hours  required  is  selected 
randomly  from  a  prescribed  distribution.  The  maintenance  man-hour  data 
are  based  on  empirical  information  obtained  from  aircraft  maintenance 
records.  Table  22  shows  the  relative  frequency  of  maintenance  man-hours 
for  general  maintenance.  The  number  of  men  assigned  to  a  specific  main¬ 
tenance  job  varies  from  one  to  four,  and  if  more  than  one  man  is  assigned, 
the  number  of  hours  the  aircraft  remains  in  the  maintenance  category  is 
reduced  accordingly.  However,  before  the  aircraft  is  placed  in  an  active 
maintenance  category,  a  test  is  made  to  see  whether  enough  unassigned  men 
are  available  to  perform  the  job.  If  not,  the  aircraft  remains  in  the  main¬ 
tenance  queue  until  enough  men  become  available.  Although  Figure  42  is 
concerned  with  general  maintenance  queues,  the  same  procedure  is  followed 
in  processing  the  propeller  queue. 
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TABLE  21.  RELATIVE  FREQUENCIES  OF  HOURS  OF  AOCP 


Hours  AOCP 

Relative 

Frequency 

Hours  AOCP 

Relative 

Frequency 

0 

0. 9002^a) 

96 

.0103 

12 

0.0015 

108 

.  0069 

24 

0. 0045 

120 

.0041 

36 

0. 0089 

132 

.  0023 

48 

0.0134 

144 

.0011 

60 

0.  0161 

156 

.0005 

72 

0. 0161 

168 

.0002 

84 

0.0138 

(a)  This  value  is  for  a  10  per  cent  probability:  if  there  were  30  per  cent  AOCP't,  this  value  would  be  0. 7008, 
and  other  frequencies  would  be  tripled. 
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TABLE  22.  RELATIVE  FREQUENCIES  OF  MAN-HOURS  REQUIRED 
FOR  GENERAL  MAINTENANCE 


Man-Hours 

Required 

Relative 

Frequency 

Man-Hours 

Required 

Relative 

Frequency 

1 

.  0081 

16 

.0356 

2 

.0360 

18 

.0291 

3 

.0397 

20 

.0449 

4 

.  0478 

25 

.0473 

5 

.  0478 

30 

.0437 

6 

.  0652 

35 

.0433 

7 

.  0664 

45 

.0469 

8 

.0563 

55 

.0324 

9 

.0579 

65 

.0162 

10 

.0797 

75 

.0146 

12 

.0793 

85 

.0073 

14 

.0445 

95 

.0101 
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Table  23  presents  the  relative  frequencies  of  man-hour  efforts  re¬ 
quired  for  propeller  maintenance.  Distribution  I  represents  empirical  data 
derived  from  aircraft  maintenance  records.  Distribution  EE  and  m  are 
assumed  distributions  representing  higher  frequencies  of  more  difficult 
maintenance  tasks.  Distribution  II  considers  an  increased  frequency  of  jobs 
requiring  10  to  11  man-hours  of  effort,  whereas  Distribution  III  describes 
more  intensive  maintenance  effort,  with  tasks  requiring  up  to  60  man-hours 
and  the  relative  frequencies  following  an  irregular  pattern. 


Processing  of  Aircraft  in  General  and  Propeller  Maintenance. 

Figure  43  indicates  the  processing  of  aircraft  in  maintenance.  When  the 
time  to  remain  in  maintenance  equals  zero,  the  aircraft  and  the  men 
assigned  are  returned  to  the  available  list.  The  complexities  of  this  block 
are  introduced  in  ascertaining  whether  both  general  and  propeller  main¬ 
tenance  are  completed  before  transferring  the  aircraft  to  an  available  status. 
This  category  of  aircraft  is  not  processed  if  the  hour  of  the  day  is  beyond 
working  hours.  For  the  analyses  performed  to  date,  it  has  been  assumed 
that  two  8-hour  shifts  with  an  equal  number  of  men  assigned  are  being  em¬ 
ployed.  A  variation  in  the  length  of  the  working  day  can  be  accomplished  by 
altering  one  constant  in  the  program. 


Processing  of  Aircraft  in  AOCP  and  Periodic  Inspection  Categories. 
The  flow  of  computations  for  AOCP  aircraft  is  not  diagrammed,  since  this 
is  handled  on  a  relatively  simple  basis.  Each  hour  the  aircraft  record  is 
examined  to  see  whether  AOCP  time  has  expired.  If  so,  the  aircraft  is 
transferred  to  the  appropriate  maintenance  queue.  The  same  procedure  is 
used  for  aircraft  in  a  periodic  inspection  status,  except  that  they  are  trans¬ 
ferred  to  an  available  category. 


Details  of  Program  Operations 

In  running  the  program  described,  it  was  found  that  about  35  minutes 
were  required  to  analyze  a  30-day  operational  period  on  an  hourly  basis. 

The  output  was  punched  at  0800  of  each  day,  since  the  hourly  variations  of 
aircraft  disposition  were  not  considered  to  be  significant.  Also,  by  not 
punching  for  each  hour,  the  speed  of  computation  was  considerably  im¬ 
proved,  since  excessive  output  retards  the  computational  speed.  Examina¬ 
tion  of  hourly  data  would  also  be  a  tedious  process,  and  it  is  therefore  de¬ 
sirable  to  generate  the  minimum  amount  of  data  that  will  provide  meaningful 
answers  in  the  light  of  the  desired  investigation. 
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TABLE  23.  RELATIVE  FREQUENCIES  OF  MAN-HOURS  REQUIRED 
FOR  PROPELLER  MAINTENANCE 


Distribution  I 
(Empirical) 

Distribution  II 
(Assumed) 

Distribution  HI 
(Assumed) 

Man-Hours 

Relative 

Frequency 

Man-Hours 

Relative 

Frequency 

Man-Hours 

Relative 

Frequency 

1 

0. 2700 

1 

0. 2000 

i 

0. 2000 

2 

0. 2700 

2 

0. 2000 

2 

0.  1000 

3 

0. 1100 

3 

0.0167 

3 

0. 0084 

4 

0.  1100 

4 

0.0167 

4 

0. 1056 

5 

0.  0700 

5 

0. 0167 

8 

0. 0056 

6 

0.0300 

6 

0.0167 

9 

0.0083 

7 

0.0300 

7 

0. 0167 

12 

0.0250 

8 

0.  0300 

8 

0.0165 

16 

0.0139 

9 

0.  0300 

9 

0.0167 

18 

0.  0250 

10 

0.  0100 

10 

0.  2000 

27 

0.  2167 

11 

0.0100 

11 

0.2000 

32 

0.0083 

12 

0.  0100 

12 

0.0167 

36 

0. 1167 

13 

0.  0050 

13 

0.0167 

48 

0. 1166 

14 

0.0050 

14 

0.0167 

64 

0.  0499 

15 

0.0050 

15 

0.0167 

16 

0.0050 

16 

0.0165 
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The  computations  were  performed  with  an  IBM  650  Data  Processing 
System.  Additional  indexing  accumulators  were  utilized  to  reduce  the  num¬ 
ber  of  instructions  required  and  to  increase  the  speed  of  calculation.  The 
Symbolic  Optimal  Assembly  ProgramU)  was  used  to  optimize  the  location  of 
instructions ,  this  being  helpful  in  reducing  the  time  required  for  computa¬ 
tion  and  in  simplifying  the  coding. 


(1)  Poley,  Stan,  SOAP  n  Programmers'  Reference  Manual.  Applied  Science  Division  Public  a  tion,  International 
Business  Machines  Corporation,  590  Madison  Avenue,  New  York,  New  York. 
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